In 2024, a small Argentine town called San Pedro became the focus of international press coverage after thousands of residents (approximately 20% of the total population), including the chief of police and members of the city council, discovered that a cryptocurrency platform they had invested in and been promoting was a coordinated scam. The platform, called RainbowEx, displayed fictional trading activity, pulled deposits from victims through stablecoin transfers, and blocked withdrawals once the scheme was publicly exposed. The complex scandal was covered by The New York Times, La Opinión Semanario, Buenos Aires Herald, and other prominent news outlets.
What happened in San Pedro made international headlines. What went under the radar was the discovery that RainbowEx was not bespoke fraud. It was a template: the visual scaffolding for the exchange, the registration flow, the trading dashboard, and the Telegram-driven price calls, were all built using a Chinese web-developer framework called DCloud Uni-App (DCloud) (en.uniapp[.]dcloud[.]io), an open-source toolkit for building cross-platform mobile applications.
DCloud is also, as Infoblox Threat Intel research now shows, the technical foundation underneath at least 236,493 distinct second-level domains identified as scam infrastructure: from RainbowEx-style fake crypto exchanges to multi-language pig-butchering operations, WhatsApp phishing networks, fake gambling platforms, brand-impersonation sites, and crypto wallet drainers. RainbowEx was not the start. It was one well-publicized chapter of a much larger, older, and still-active operation. One where the scaffolding is shared, many of the actors are decentralized, and countless victims are globally dispersed.
In our investigation of scam websites using DCloud, we were also able to map some hosting patterns and private technical fingerprints, which points to at least one large-scale threat actor controlling a large portion of these scam sites.
And what we observed online has not stayed only online. The same investment scam template family now anchors physical-world fraud operations, including the 2024–2025 Lightning Shared Scooter Co. (LSSC) mobility investment scam that the U.S. press extensively covered last August, and a currently-active bicycle sharing investment scam registered with the U.S. Treasury Department as a money-services business, recruiting Americans through another mobility investment scam at the time of this writing.
This is the story of the DCloud open-source framework, why defenders should be tracking websites built with it, and how we can use this shared code to better understand the investment scam ecosystem emanating from mostly Chinese threat actors.
What is DCloud, and Why Does it Matter?
DCloud is a Chinese open-source software company based in Beijing. Its flagship product, the Uni-App framework, is a cross-platform development toolkit (analogous to React Native or Flutter) that lets developers write a single Vue.js codebase and deploy it as a mobile application, a desktop application, and a mobile-optimized website simultaneously. The framework is legitimate, widely used in mainland China, and supported by an active developer ecosystem. Thousands of legitimate Chinese businesses ship products built on it, and we have no evidence DCloud is involved in the fraudulent use of its framework by these actors.
The framework leaves behind a recognizable shape. Every Uni-App project, by default, ships with a handful of shared resources; none of them are inherently malicious. They are simply the default scaffolding that every Uni-App project includes when it is built, the way every WordPress site shares certain underlying file paths, and every React app ships with a recognizable build artifacts.
There are likely threat actors selling DCloud investment scam templates, but we’ve also found indications of centralized ownership across huge swaths of DCloud investment scam websites. Beyond the technical connections, we also uncovered patterns in the growth of the DCloud investment sites, along with coordinated dips in new domain registrations seen across scam websites on diverse hosts, an indication of a centralized owner facing disruption or making coordinated changes across all their DCloud investment scam sites.
From RainbowEx to a Much Larger Ecosystem
The RainbowEx exchange that swept San Pedro was hosted primarily on just one website (rainbowex[.]cc). Investigators who looked at its code in late 2024 quickly realized it had been built on the DCloud Uni-App framework, and this detail made its way into early news reports and then eventually into the huge New York Times article “How a Crypto Craze Swept An Argentine Town.”
Infoblox Threat Intel undertook a research process to use technical fingerprints common to sites built on the DCloud framework. We identified a large population of domains—hundreds of thousands of them—that are both using DCloud and conducting a wide range of scams. Use of DCloud itself is not, on its own, evidence of malicious intent. Legitimate developers ship sites with it too. What separates the malicious population from the legitimate one is what gets layered on top of the framework: fake brokerage interfaces, cryptocurrency wallet-drainer prompts, gambling interfaces with rigged outcomes, brand-impersonation storefronts, and the rest of the modern online-fraud playbook.
We were able to develop additional technical fingerprints to filter out the known malicious DCloud websites from the generic sites. The scam website found using DCloud also had a small portion that attempted to remove DCloud fingerprints, and our data showed these evasive websites were hosted on more bulletproof hosting (BPH) providers than the vanilla scam sites, indicating greater sophistication by some of the actors using this framework.
After filtering out legitimate enterprise customers of the DCloud framework (large platforms, multi-tenant SaaS, established Chinese businesses) we identified over 236,000 distinct second-level domains (SLDs) that appear to have been operated for fraudulent purposes since 2022. These domains span every continent, target speakers of at least eight languages, and impersonate brands ranging from major stock exchanges to retail giants to messaging platforms.
And when we look at the broad scope of this data, there are trends that indicate centralized operators behind many of the investment scam websites.
The Scale of the Investment Scam Population
Across the focused investment scam collection (the population shown in Figure 1 below), Infoblox has analyzed:
- More than 236,000 distinct SLDs with DCloud-built investment scams have been launched since mid 2022, hosted across numerous providers.
- From 2022 to the present, hundreds of thousands of scam websites were built with DCloud but we see the steepest growth following the late-2024 public attention around RainbowEx.
Figure 1. Distinct DCloud-built investment scam second-level domains observed over time, broken down by hosting operator: 236,493 total second level domains across from 2022-2026. The red dashed line marks October 2024, when the RainbowEx–DCloud connection became public.
Before October 2024, when the RainbowEx story broke internationally, there were a few thousand DCloud-fingerprinted scam sites observed per month, with steady growth from a small base. After October 2024, that figure jumped to roughly 15,000 newly observed sites per month at peak. The framework appears to have become a known platform within the scam-operator ecosystem due to the coverage it received by major news outlets.
We are currently tracking two related but distinct populations of DCloud-fingerprinted sites. First is the broader population: sites carrying the DCloud Uni-App framework’s basic fingerprints. This group goes back to 2021 and includes both legitimate Chinese businesses and malicious operations. The second group is an investment scam-specific subset and is what we’re showing in Figure 1. We identified these domains using additional fingerprints tied to the DCloud investment scam templates themselves (which appear to be sold privately between operators rather than distributed through any public DCloud channel). The actors started using these domains in mid-2022.
Counterintuitively, the investment scam population is larger than what the simple DCloud framework fingerprint alone reveals, because more sophisticated operators have stripped the default DCloud scaffolding to evade fingerprint-based identification. However, we still caught them using additional scam-specific fingerprints. The shapes of both curves are very similar over time, which is itself a finding: the overwhelming majority of DCloud-fingerprinted sites we observe are some form of investment scam or related fraud. The rest of this report focuses on the investment scam subset specifically.
A Taxonomy of DCloud-Built Scams
The most important thing to understand about the DCloud-built scam websites is that there is not a single threat actor behind them all, although there are patterns that point to significant swaths of the sites being centrally controlled. We know there are multiple unrelated operators running DCloud scam websites—quite possibly dozens, even hundreds. But when these sites are further analyzed, specific technical fingerprints, communication methods to victims, hosting decisions, and other details indicate that there is some centralized control of a large portion of the scam sites using DCloud.
We have clustered the scams into roughly the following families, based on visual and technical examinations of a large sample of the population.
Fake crypto exchanges and “deposit-and-trade” platforms. This is the largest category of scam sites by a significant margin. These platforms impersonate well-known exchanges or invent fictional ones, present a registration flow typically with an “invite code” to limit signups, accept deposits in Tether or other stablecoins (some even accept Zelle or other traditional payment methods) and display fictional trading activity until the victim attempts to withdraw funds. RainbowEx is the most prominent example of these fake investment sites. Sites in this category often impersonate genuine financial brands: HKEX (Hong Kong Exchanges), Nasdaq, Tesla-themed crypto programs, or generic names like “DawnEX” or “CoinexPro” designed to evoke real exchanges without infringing on real brands. See Figures 2 and 3.
Figure 2. Screenshot of a DCloud-built site (hkxiu[.]com) impersonating the Hong Kong Stock Exchange (“HKGX”), using the brand “Hong Kong Gold Exchange” to evade direct trademark identification
Figure 3. Screenshot of a DCloud-built site impersonating Nasdaq (nasdaqpro[.]top), and using stock footage of the Nasdaq closing bell ceremony to project legitimacy
Crypto wallet drainers. These sites present a “verify your wallet” or “connect your wallet” prompt—sometimes claiming to be official BNB Chain, Tether, or other crypto-platform verification flows—and then drain any wallet that connects. See Figure 4.
Figure 4. Screenshot from bepviews[.]com, a DCloud-built wallet drainer impersonating BNB Chain verification flows; the “Verify Asset” button initiates a wallet drain
Prediction-market and gambling impersonations. Clones of Polymarket-style prediction markets (Figure 5), or fake casinos and lottery platforms are becoming more common. An informal term for these websites is “scambling” (scam gambling), referring to gambling sites where the operator simply does not pay out winnings (Figure 6). There’s been an increase in these since Brian Krebs published a prominent article on scambling in July 2025.
Figure 5. Screenshot of polymk[.]com, a DCloud-built clone of the prediction-market platform Polymarket
Figure 6. Screenshot of a DCloud-built Portuguese-language “scambling” site (mango-cleopatrapg[.]com), which is mobile-optimized and targets Portuguese and Spanish speakers
WhatsApp and messaging platform phishing. It is somewhat common to find templates across the DCloud ecosystem that are designed to extract credentials by impersonating WhatsApp’s “Security Help Center” or similar trust-evoking interfaces. These seven WhatsApp-themed scam domains (“whats-zwp[.]vip”, “whats-zrs[.]vip”, “whats-zef[.]vip”, “whats-zea[.]vip”, “whats-zus[.]vip”, “whats-zei[.]vip”, “whats-zen[.]vip”) were used in attacks over the last year. We also saw faq-whatsapp-center[.]com, a slight variation we show in Figure 7.
Figure 7. Screenshot of a DCloud-built WhatsApp phishing template (faq-whatsapp-center[.]com), presenting itself as a WhatsApp “Help Center” verification flow
Generic template phishing and credential collection. Many DCloud-built scam sites are not visually distinctive at all—they include simple login and registration pages with a stock background photo, and a few contact or social media links on the pages. The site lsscol[.]com from Lightning Shared Scooter Co. (LSSC) is the single most accesed DCloud-fingerprinted scam in our visible population. Over 50 distinct Infoblox enterprise customers had devices that tried to reach this site, and it shows nothing more than a user login form.
lsscol[.]com was one of the main domains used by the LSSC scam last year. Numerous sources including The Better Business Bureau, the Financial and Consumer Services Commission of New Brunswick, and the Minnesota Attorney Generals office confirmed that lsscol[.]com and lssc[.]ltd were used by the LSSC scooter rental pyramid investment scam last year in the U.S., along with a domain used to target Canadian investors, lssc-canada[.]ca.
Figure 8. Screenshot of lsscol[.]com, a generic DCloud-built credential-collection page. It’s been visited by devices belonging to 50 distinct enterprise customers across multiple industries.
From Argentina to America: When Scam Sites using DCloud Impact Main Street
As detailed above, there are a wide range of scams that cybercriminals build using the DCloud framework. One such scam—the “deposit a small amount, watch your money grow, recruit your friends” investment scam—has been the most adaptable and the most successful at crossing languages and geographic boundaries.
The Argentine RainbowEx case is an investment scam using DCloud that the international press has covered very thoroughly. In the United States, the same playbook has now manifested twice in publicly known operations: first in the LSSC scooter sharing investment scam that scaled into a major federal–and–state fraud investigation last year, and second in a bicycle sharing investment-themed scam that is actively recruiting victims right now under a U.K.-registered corporate front with a genuine U.S. federal money-services license.
Lightning Shared Scooter Co.: The Biggest Scooter Investment Scam in the U.S.
Between mid-2024 and August 2025, an operation called Lightning Shared Scooter Co. (LSSC) recruited investors across the United States with a pitch nearly identical to RainbowEx’s, but localized for an American audience. Investors were told they could earn passive income by funding a high-tech scooter-sharing company “based in Hong Kong,” log into an app at night, hit a button to “run” their scooters, and watch the money in their accounts tick up. The promised returns were extraordinary. Unlike the Argentine version, LSSC had a physical-world legitimacy layer: it opened storefronts in at least eight U.S. cities, filled them with sleek black scooters that actually worked, and filed state-level incorporation paperwork.
According to NBC News’s August 2025 investigation of the scheme, the pitch attracted endorsements from small-town mayors, police officers, and a U.S. Army lieutenant colonel. Former White House Press Secretary Sean Spicer appeared to mention the company on Cameo. (Spicer told NBC his recording was intended for an individual, not for promotional use.) In Cleveland, Mississippi, their police department went so far as to give away four LSSC scooters as prizes to local schoolchildren, and a video circulated of a Cleveland officer inside the LSSC storefront declaring, “LSSC is not a scam. This is actual proof that this is real.” (Facebook video of officer endorsement, starts at ~8:20).
But LSSC was not real. By August 2025, Salinas, California police had identified more than five dozen victims in their jurisdiction alone whose combined losses totaled over $370,700. Arlington County, Virginia officer Kyle Hoffman, working with the FBI’s Richmond field office, estimated total U.S. losses to be “easily in the millions.” The Better Business Bureau, after receiving complaints from victims in 20 states, formally labeled LSSC a pyramid scheme. NBC News interviewed a dozen victims who collectively injected more than $190,000 into the operation. Individual losses ranged from smaller amounts all the way into the six figures.
Victims interviewed by NBC described experiences that followed the broader investment scam template. Patricia Livingstone, a Philadelphia group-home manager who lost approximately $11,000, said the daily required trading routine her LSSC “manager” imposed left her feeling like she was “in a cult, like a zombie.” Tah-Ming Lee, who rented a Sandy Springs, Georgia office for LSSC meetings, said he and his recruits eventually suspected they were communicating with an automated chat handler: “We thought all these managers were AI.” Both observations match the broader scam site funnel: daily engagement requirements that gamify the experience, combined with scripted or increasingly automated off-platform chat handlers that scale recruiter-to-victim ratios well beyond what any human operation (even if they use slave labor) could sustain.
The financial–fraud mechanics of LSSC closely align with other known investment scams. Investors deposited around $2k each by Zelle or Cash App, watched the amount converted into “cryptocurrency” inside the LSSC app, observed fictional daily revenue accumulate, and were eventually unable to withdraw. When withdrawal failures became widespread, the operators asked members to pay a “$75 account verification fee” to release funds—a last-ditch effort to scam their victims. After the scam collapsed, a successor pitch named “New LSSC” circulated, demanding that members invite 30 new users to qualify for “priority refund processing.”
The original LSSC frontends are now offline, but we are nonetheless able to confirm that LSSC was using DCloud frameworks on their website and apps. Yale Privacy Lab researcher Sean O’Brien, who reviewed the LSSC Android app for NBC News at the time the scam was still active, shared additional artifacts from his analysis with Infoblox researchers, including captured screenshots of the now-defunct lsscapp[.]com landing page (Figures 9 and 10) and a decompiled AndroidManifest.xml from the LSSC Android application (Figure 11). The manifest contains the DCloud Uni-App framework’s characteristic package naming convention and application class.
Figure 9. Screenshot of the now offline lsscapp[.]com landing page, captured by Sean O’Brien (Yale Privacy Lab) during the active period of the LSSC scam
Figure 10. Screenshot of a second variant of the lsscapp[.]com landing page with the scooter-and-rider character imagery used to give the operation visual legitimacy
<?xml version=”1.0″ encoding=”utf-8″?>
<manifest package=”uni.UNI37480E2″>
<application
android:name=”io.DCloud.application.DCloudApplication”>
<activity android:name=”io.DCloud.WebviewActivity”/>
<activity android:name=”io.DCloud.WebAppActivity”/>
<activity android:name=”io.DCloud.ProcessMediator”/>
[…]
</application>
</manifest>
Figure 11. Excerpt from the AndroidManifest.xml of the LSSC Android app, shared by Sean O’Brien. The package name (uni.UNI37480E2) follows DCloud’s standard Uni-App build convention, and the Application class (io.DCloud.application.DCloudApplication) and Activity classes (io.DCloud.WebviewActivity, io.DCloud.WebAppActivity, io.DCloud.ProcessMediator) are DCloud framework components, i.e. LSSC’s mobile app was built directly on the DCloud Uni-App stack.
NBC News reported that when O’Brien reviewed the LSSC app, he also found it laden with Chinese tech stack components (references to QQ, Taobao, Alibaba) and an Apple privacy policy whose title literally read Untitled document in Chinese. These features are consistent with a rapid-deployment template repurposed across operators.
LSSC also promoted a related cryptocurrency platform called Lightning Exchange (“Lightning Coin” or LNC), traded through the site lightacer[.]com.
The LSSC affiliate ecosystem published step-by-step tutorials walking new recruits through registration on the LNC trading platform: phone, password, invitation code, and graphic CAPTCHA (Figures 12 and 13). These tutorials and components form a registration shape that aligns precisely with the DCloud-built investment scam template we observe at scale. Unfortunately, there is limited historical data associated with the lightacer[.]com domain, so we cannot confirm the domain was setup with the DCloud framework.
Figure 12. An archived “How to Get Started with LNC Lightning Coin” tutorial from a now-shuttered LSSC affiliate site (lssc-canada[.]ca), captured by the Wayback Machine. The embedded mobile screenshot at the bottom of the page is the LNC trading platform (lightacer[.]com).
Figure 13. The standalone lightacer[.]com Create Account screen used by LSSC affiliates to onboard victims into the related “Lightning Coin” trading platform. The four-field invitation code, gated phone, and password registration with graphic CAPTCHA aligns precisely with the DCloud-built investment scam template observed across the broader population.
Yuechi Sharing Technology Ltd. (YST): Active 2026 Scooter Investment Scam
While LSSC was being investigated by the FBI and shut down across U.S. states, a structurally similar operation was being stood up under a different brand. Yuechi Sharing Technology Ltd. (YST) is currently live, primarily targeting Australia, New Zealand, and the United States, and has invested significant effort in establishing apparent regulatory legitimacy.
Figure 14. Yuechi Sharing Technology Ltd. Branding with the acronym they use, “YST”
We know of two domains that the Yuechi front appears to operate, though there could be more: ystl03106[.]top (the live recruitment platform, as of this writing) and ys904[.]top (its public-facing “anti-fraud notice” satellite). See Figures 15 and 16. Yuechi also runs a YouTube channel, an X (Twitter) account, and a customer service chat backend (aqy.dot02ig[.]cfd).
Figure 15. Screenshot of the ystl03106[.]top login landing page (geographically targeted: the default telephone country code in this capture is +64, New Zealand). Note the robot chat link, YouTube, and X/Twitter link in the upper-right, alongside an anti-fraud badge that links to a defensive anti-fraud notice on a sister domain, ys904[.]top.
Figure 16. Screenshot of the ys904[.]top “Important Anti-Fraud Notice (Must Read)” landing page. The notice defends YS as a legitimate pyramid investment business and investment opportunity in the “shared bicycle” industry.
We confirmed that the Yuechi frontend is built on the DCloud Uni-App framework and found connections between this investment scam and a network of other investment scam websites.
What is novel about Yuechi, compared to most investment scams, is that their registration paperwork is real. The operators behind Yuechi obtained and prominently display two genuine government registrations:
- A Hong Kong Certificate of Incorporation (Registration No. 77975280, issued 8 April 2025) for “躍馳共享科技有限公司”/Yuechi Shared Technology Co., Ltd. a legitimate corporate registration with the Hong Kong Companies Registry. See Figure 17.
- A U.S. FinCEN Money Services Business (MSB) registration (Registration No. 31000300306222, initial registration filed 15 May 2025), listing an address in Manchester, UK (125 Deansgate, M3 2BY), an activity scope including all 50 U.S. states plus territories, and the business activities as money transmitter, money order, traveler’s check, prepaid access, and check cashing activities. We confirmed the registration directly against the public FinCEN MSB Registrant Search, and show the result in Figure 18.
Figure 17. The Hong Kong Companies Registry Certificate of Incorporation that Yuechi’s operators rely on as a second legitimacy prop, issued 8 April 2025. The certificate confers no operational license; it documents that a limited company by that name was filed with the Hong Kong registrar.
Figure 18. Yuechi’s genuine FinCEN MSB registration record. The registration is real; the FinCEN page itself warns that registration is not an endorsement and “may be part of a scam or attempt to deceive consumers.”
Neither registration confers any legitimacy on the underlying operation, and FinCEN is publicly aware that its registration process is sometimes being weaponized for exactly this purpose. Its own MSB Registrant Search page leads with an explicit warning: “Fraudsters are using the Financial Crimes Enforcement Network’s (FinCEN’s) money services business (MSB) registration process to defraud the public. You should not trust a company only because it is listed on this Web page.” FinCEN also published a December 2024 alert on fraud schemes abusing the agency’s name, insignia, and authorities for financial gain (Figure 19).
Figure 19. The warning that opens the FinCEN MSB Registrant Search page, explicitly stating that fraudsters are abusing the registration process.
To a prospective victim being asked to give the operator money, a U.S. Treasury Department registration number with a corresponding entry in a federal database that anyone can look up is a strong signal of legitimacy. The YST site presents these credentials prominently, alongside text framing the operation as a “U.S.-authorized money services business … providing money remittance, currency exchange, check cashing, and cryptocurrency-related services.” The combination of real paperwork plus a publicly visible defensive “anti-fraud notice” is the operator’s answer to the kind of skepticism LSSC ran into when investigations began.
Yuechi is a convincing front, but fortunately, there are experts like independent investigator Danny De Hek, who was approached to join the Yuechi Sharing Technology Ltd (YST) investment scam in 2025. He went along with it and ended up documenting significant details about the scam lures and process in his report, “How I Got Approached by Yuechi Sharing Technology Ltd (YST) and Uncovered a Likely Ponzi Operation” and corresponding YouTube video, “Yuechi Sharing Technology Ltd (YST) Rideshare Job Scam Using Motorbike App & Passive Income Claims.” See Figure 20
Figure 20. Screenshot from Independent investigator Danny De Hek’s YouTube exposé “Yuechi Sharing Technology Ltd (YST) Rideshare Job Scam Using Motorbike App & Passive Income Claims,” documenting being approached by YST recruiters and walking through the recruitment funnel
What the Current Yuechi Operation Looks Like to a Victim in 2026
The ystl03106[.]top frontend includes a phone number and password login with a separate registration requiring: a phone number, password, a graphic CAPTCHA, an SMS verification code, and an invitation code (Figure 21).
Figure 21. Screenshot of the Register form for the Yuechi investment website at ystl03106[.]top
The invitation code gate is common across investment scam websites: a prospective victim cannot create an account or reach the deposit screen without first being recruited by an existing affiliate. This requirement aligns with the fact that most operators seek to convert each victim into a recruiter who will then try to recruit their own friends, family, and co-workers to bring in more investments and build out the pyramid.
If someone has trouble logging into the Yuechi website and reaches out to the customer support chat, a simple graphic is shared. It looks suspiciously similar to other “support graphics” shared by seemingly unrelated investment scam websites using the DCloud framework (Figure 22).
Figure 22. Screenshot of the Yuechi registration tutorial graphic distributed by the operator to onboard recruits, with a bicycle visual matching the “shared bike economy” cover story. The six field registration shape (phone, password, confirm password, picture code, SMS verification, invitation code) is identical to other brands in the same operator cluster.
When a victim hits any kind of failure inside the app (e.g., a registration error, a deposit hold, or a withdrawal block), the customer service handler funnels them to an off-platform branded chat with an “online customer service” operator. The chat’s behavior matches what RainbowEx victims described to Argentine journalists: the operator is conversational, reassuring, persistent, and ultimately points the victim back at their “recommender teacher” (the upline referrer who recruited them) to handle anything substantive. We engaged with the Yuechi chat operators to confirm this behavior, shown in the Figure 23’s graphic below.
Figure 23. Screenshot of the “Online customer service” chat after a verification-code failure. The script “Hello, please contact your recommender teacher to verify and deal with it for you” is extremely similar to the customer service responses victims of related operations have described and funnels prospective victims back through the recruiter.
Yuechi Investment Site Aligns to Other Active Investment Scam Websites
Yuechi is just one of many investment scams online right now that are using the DCloud framework, but it has common technical fingerprints with other sites, indicating a centralized operator.
Two additional websites that are hosting investment scams and using the DCloud framework, xaai3xj[.]com and xaaitbb[.]com, are marketed publicly as “XAEL-AI” and are not only nearly identical from a code perspective, but their operations share similar graphics when a user has a problem logging into their sites.
Both brand websites contain hard-coded operator identifiers that act as a high confidence operator signature: a 29-language localization pack that includes unusual diaspora-targeted languages (Haitian Creole, Kinyarwanda, Albanian, Uzbek) alongside the more typical English, Spanish, and Mandarin set; and failure message strings throughout the application that funnel victims to an off-platform branded customer service chat whenever a withdrawal, deposit, or activation fails. The chat backend reachable from XAEL-AI is the same technical setup as the chat backend reachable from the Yuechi website.
XAEL-AI dresses the same engine in different clothes: an “AI investment” narrative instead of futuristic bicycle investment platform. But the registration flow is identical to Yuechi. And if you have a problem and reach out to their chat, an image very similar to that seen previously on the Yuechi portal is shared (see Figure 24).
Figure 24. Screenshot of the XAEL-AI brand registration tutorial with an identical six-field shape to YST (Figure 22).
The Hosting Layer
Most DCloud-built investment scam infrastructure runs on legitimate hosting providers. The four largest operators visible across the population are Cloudflare, Alibaba Cloud, Tencent Cloud, and Amazon Web Services, the same hyperscalers that host hundreds of thousands of legitimate businesses. Scam operators use them for the same reasons everyone else does: They’re inexpensive, reliable, easy to spin up, and difficult for victims to distinguish from any other site.
The pattern of legitimate-host abuse is the dominant signal in the dataset. Across the visible population, roughly 94% of identified investment scam SLDs resolve to ASNs that also host vast volumes of legitimate web traffic. Defenders cannot simply block these providers except at the domain level. Hosting alone is not a useful signal.
The minority of the population that does not run on legitimate hosts is where things become much more interesting.
Using the Spamhaus DROP ASN list, which identifies autonomous systems with high concentrations of malicious activity and bulletproof-hosting characteristics, we flagged approximately 6% of visible DCloud-built investment scam SLDs as bulletproof-hosted. These 1,024 sites collectively receive over 320,000 enterprise DNS queries since mid 2022 and reach roughly 265 distinct enterprise customers. The BPH segment is smaller in volume than the legitimately hosted majority, but this BPH segment is particularly interesting because it appears that the operators of these sites took efforts to hide other fingerprints.
And within that 6%, one provider dominates completely: CTG Server.
CTG Server: a Name That Keeps Appearing in Threat Investigations
Within the bulletproof-hosted slice of the DCloud-built investment scam population, AS152194 CTG Server Limited (myctgs[.]com), registered in Hong Kong, appears with overwhelming frequency. Of the top twenty bulletproof hosted SLDs ranked we’ve seen in our cloud customers, nineteen are on CTG Server.
CTG Server is well known to threat researchers and is listed in the ASN droplist from SpamHaus, encouraging legitimate organizations not to peer or associate with the company. The provider has been previously documented hosting Chinese affiliated scam infrastructure across multiple unrelated campaigns for pig-butchering operations, cryptocurrency fraud, fake e-commerce platforms, fake casinos used for money laundering, and related categories that are increasingly the focus of international law enforcement scrutiny. Multiple distinct threat operators favor CTG Server as a backend, suggesting that whatever the provider offers, likely some combination of low cost, lax content policy, and resistance to abuse complaints, has become a de facto standard for Chinese-language and Chinese-affiliated fraud operations.
When DCloud Operators Try to Hide
Not every DCloud-built investment scam site carries the default DCloud framework fingerprint. Some operators have stripped or modified the code in what appears to be a deliberate attempt to evade fingerprint-based identification. Infoblox tracks two distinct tiers in the population: the vanilla tier, which consists of operators who left the DCloud framework’s default scaffolding intact, and the evasive tier, which consists of operators who’ve removed it. Both tiers behave identically as scams. The only difference is whether the operator made an effort to be harder to find.
Their infrastructure, however, tells a different story. Sites in the evasive tier, where operators took the trouble to obscure the framework signature, run on bulletproof hosting at roughly double the rate of the vanilla tier. In a typical month, the vanilla tier shows a 5–10% bulletproof share, while the evasive tier sits at 14–17%, with occasional months spiking to 25–30%. See Figure 25.
Figure 25. Bulletproof hosting share over time for vanilla operators (default fingerprints intact) versus evasive operators (fingerprints stripped). The evasive tier sporadically runs at roughly twice the BPH share of vanilla.
The interpretation is straightforward: Operators sophisticated enough to recognize and strip framework fingerprints are also operators sophisticated enough to seek out infrastructure providers that resist takedown requests. The two behaviors tend to go hand in hand. Conversely, the cheapest and least sophisticated operators, those who download a template and deploy it as-is, are also the most likely to be using mainstream hosting, where they are simultaneously easier to identify and easier to remove.
This split matters for defenders. It means that the easy-to-track infrastructure of this DCloud ecosystem represents the cheap, replaceable layer. The harder-to-track tier is smaller, but materially more durable and likely to stay online longer.
Enterprise Exposure: Who is Reaching These Sites from Work?
The visible population, the subset of DCloud-built investment scam domains that one or more Infoblox enterprise customers have queried at least once since January 2024, comprises just over 18,000 SLDs. Across them, approximately 985 distinct enterprise customers had devices that tried to connect to DCloud-built investment scam infrastructure. These customers operate across 25 industry verticals, ranging from the smallest measured exposure (Agriculture, with a single affected customer) to the largest by count (Government, with over 100).
The volume per site is small, but as Figure 26 shows, the aggregate is not.
Figure 26. Aggregate enterprise DNS query volume to DCloud-built investment scam infrastructure, by industry vertical. Log scale; values have been rounded to indicate magnitude rather than precise counts.
In total, the visible DCloud-built investment scam population is the destination of more than five million enterprise DNS queries. Roughly a quarter of that total volume comes from the top 500 highest-impact SLDs; the remaining three quarters comes from the long tail of over 17,500 SLDs, which individually generate only modest activity but collectively account for the bulk of exposure. Food and Beverage shows the largest aggregate query volume by a wide margin, driven primarily by a single high-volume site (the LSSC scam), followed by Banking, Government, IT Consulting, Education, and Financial Services (Figure 27).
Figure 27. The same industry breakdown as Figure 25, split by hosting category. The BPH share (red) is small but consistently present, with Banking showing the largest absolute BPH hosted query volume.
The distribution is most notable. No single DCloud-built investment scam domains received more than approximately 20,000 enterprise queries from any single customer. These are not high-volume websites for any one organization. They are individual employees, on personal devices brought to work, or on corporate networks during off-hours, trying to reach scam sites one or two times, most likely after receiving a link via WhatsApp, Telegram, social media, or messaging. The aggregate enterprise exposure is the sum of tens of thousands of these individual small volume contacts.
The vertical pattern in the data closely matches the industries where employees commonly use mobile devices on corporate Wi-Fi, where bring-your-own-device policies are permissive, and where consumer-targeted scam content is most likely to be encountered during personal browsing. The exposure is likely not the result of enterprise targeting. It is the result of consumer targeting that happens to leak into corporate telemetry through the personal lives of corporate employees.
Disruptions and Recoveries Allude to a Centralized Operator
The longitudinal picture of DCloud-built investment scam infrastructure shows two pronounced declines during the past twelve months. In late July through September 2025, the visible monthly active SLD count dropped from approximately 14,000 to under 5,000, a decline of roughly two thirds over six weeks. After a partial recovery through autumn 2025, a second decline beginning in late January 2026 took the visible count from roughly 8,500 to under 5,000 again, before another partial recovery. See Figure 28.
Figure 28. Monthly active DCloud-built investment scam SLDs from January 2025 to the present, broken down by hosting operator. Two distinct declines are visible: a sharp drop from July to September 2025, and a second drop beginning in January 2026.
These drops do not appear to be the result of any change in our detection methodology, nor any visible shift in DCloud framework adoption itself. The most consistent explanation is disruption of the operator base or its backend infrastructure during these windows.
There were disruptions during this period against scam center compounds, and certain operators of pig butchering schemes, but we haven’t been able to definitively tie any specific disruptions to these drops in active domains.
What DCloud Means for Defenders
DNS protection is well-suited to the shape of this threat: the operators are decentralized and short lived, the victims are individual users on personal or work devices, and the targets are domains that, by their nature, must be reachable from the open internet to function as scams at all. Blocking the scam hosts at the DNS layer interrupts the scam before the user reaches the page, regardless of which messaging platform, social network, or other social engineering scheme delivered them there.
For defenders generally, the practical implications are these.
This is a consumer fraud problem with enterprise consequences. Employees are the victims, not the network. Detection focused on enterprise targeting will miss this entirely. The signature is in volume, many distinct domains, each with light per-employee touch, rather than concentration on any one indicator.
Awareness training should match the geography and the social context. Pig butchering, fake exchange, fake marketplace, and now physical storefront backed “passive income” scams are the dominant categories, with strong concentration in Mandarin, Spanish, Portuguese, and English-language variants. The LSSC case shows that scams in this family can recruit through churches, co-workers, family WhatsApp groups, and small-town civic figures, channels conventional employee phishing training does not address. Training that covers consumer-fraud patterns and pyramid-investment recruitment, not just enterprise-targeted phishing, will be materially more useful.
Government registration is not vetting or any sort of government approval. The Yuechi Sharing Technology Ltd. case demonstrates that operators are now willing to file paperwork with the U.S. Treasury Department and Hong Kong Companies Registry as part of the legitimacy construction effort. A FinCEN MSB registration number, by itself, says only that someone filed a form. The presence of registration paperwork in an investment pitch is not a defense and may in fact, if aggressively shown to users, be a red flag.
Law Enforcement needs to double down on tracking DCloud scam websites. For the last two years there’s been a dramatic scaling up of scam websites using the DCloud framework, and operators of these sites continue to launch complex real-world schemes to trick victims. It’s overdue to holistically track threat actors operating in this ecosystem and attempt to identify commonalities that indicate shared ownership of the sites. We also need more attention on the Bulletproof Hosting Provider CTG Server ASN, which continues to rent IPs to a wide range of Chinese threat actors.
Indicators
The following is a representative, not exhaustive, selection of SLDs from across the DCloud-built scam ecosystem covered in this report, grouped by category. The list of indicators is also available in our open Github repository.
|
Indicators |
Description |
|
rainbowex[.]cc nasdaqpro[.]top futureblockchain[.]net kirbycoco[.]cc clintile[.]com datashareclub[.]com |
Fake crypto exchanges and “passive income” investment platforms |
|
bepviews[.]com |
Crypto wallet drainers |
|
lsscapp[.]com lssc-canada[.]ca lightacer[.]com lsscol[.]com |
LSSC investment scam domains |
|
ystl03106[.]top ys904[.]top aqy.dot02ig[.]cfd |
Yuechi Sharing Technology Ltd. domains |
|
xaai3xj[.]com xaaitbb[.]com |
XAEL-AI investment scam |
|
polymk[.]com mango-cleopatrapg[.]com deepseekpg[.]bet jp7[.]com |
Prediction-market and gambling (“scambling”) impersonations |
|
whats-zwp[.]vip whats-zrs[.]vip whats-zef[.]vip whats-zea[.]vip whats-zus[.]vip whats-zei[.]vip whats-zen[.]vip faq-whatsapp-center[.]com verify-what[.]com |
WhatsApp and messaging-platform phishing |
|
allegro-stroe[.]com allegro-stroe[.]shop allegro-stroe[.]cc allegro-stroe[.]cyou allegrostroe[.]com allegrostroe[.]cc allegrostroe[.]shop allegrostroe[.]cyou allegroau[.]com allegroau[.]cc correoargentino-comarr[.]top k-usdt[.]com usdtflow[.]net energy5[.]cyou forwarsprite[.]com g3user[.]com mypal[.]pro inetcontrol[.]net m0vrsq6[.]top |
Other scam domains |
