{"id":13776,"date":"2026-06-25T05:58:34","date_gmt":"2026-06-25T12:58:34","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=13776"},"modified":"2026-06-25T08:26:16","modified_gmt":"2026-06-25T15:26:16","slug":"from-san-pedro-to-salinas-how-a-chinese-framework-dcloud-uni-app-powers-a-global-scam-economy","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/from-san-pedro-to-salinas-how-a-chinese-framework-dcloud-uni-app-powers-a-global-scam-economy\/","title":{"rendered":"From San Pedro to Salinas: How a Chinese Framework \u201cDCloud Uni-App\u201d Powers a Global Scam Economy"},"content":{"rendered":"

In 2024, a small Argentine town called San Pedro became the focus of international press coverage after thousands of residents (approximately 20% of the total population), including the chief of police and members of the city council, discovered that a cryptocurrency platform they had invested in and been promoting was a coordinated scam. The platform, called RainbowEx, displayed fictional trading activity, pulled deposits from victims through stablecoin transfers, and blocked withdrawals once the scheme was publicly exposed. The complex scandal was covered by The New York Times<\/a>, La Opini\u00f3n Semanario<\/a>, Buenos Aires Herald<\/a>, and other prominent news outlets.<\/p>\n

What happened in San Pedro made international headlines. What went under the radar was the discovery that RainbowEx was not bespoke fraud. It was a template<\/em>: the visual scaffolding for the exchange, the registration flow, the trading dashboard, and the Telegram-driven price calls, were all built using a Chinese web-developer framework called DCloud Uni-App <\/strong>(DCloud) <\/strong>(en.uniapp[.]dcloud[.]io), an open-source toolkit for building cross-platform mobile applications.<\/p>\n

DCloud is also, as Infoblox Threat Intel research now shows, the technical foundation underneath at least 236,493 distinct second-level domains <\/strong>identified as scam infrastructure: from RainbowEx-style fake crypto exchanges to multi-language pig-butchering operations, WhatsApp phishing networks, fake gambling platforms, brand-impersonation sites, and crypto wallet drainers. RainbowEx was not the start. It was one well-publicized chapter of a much larger, older, and still-active operation. One where the scaffolding is shared, many of the actors are decentralized, and countless victims are globally dispersed. <\/p>\n

In our investigation of scam websites using DCloud, we were also able to map some hosting patterns and private technical fingerprints, which points to at least one large-scale threat actor controlling a large portion of these scam sites.<\/p>\n

And what we observed online has not stayed only online. The same investment scam template family now anchors physical-world fraud operations, including the 2024\u20132025 Lightning Shared Scooter Co. (LSSC) mobility investment scam that the U.S. press extensively covered<\/a> last August, and a currently-active bicycle sharing investment scam registered with the U.S. Treasury Department as a money-services business, recruiting Americans through another mobility investment scam at the time of this writing.<\/p>\n

This is the story of the DCloud open-source framework, why defenders should be tracking websites built with it, and how we can use this shared code to better understand the investment scam ecosystem emanating from mostly Chinese threat actors.<\/p>\n

What is DCloud, and Why Does it Matter?<\/h3>\n

DCloud is a Chinese open-source software company based in Beijing. Its flagship product, the Uni-App framework<\/a>, is a cross-platform development toolkit (analogous to React Native or Flutter) that lets developers write a single Vue.js codebase and deploy it as a mobile application, a desktop application, and a mobile-optimized website simultaneously. The framework is legitimate, widely used in mainland China, and supported by an active developer ecosystem. Thousands of legitimate Chinese businesses ship products built on it, and we have no evidence DCloud is involved in the fraudulent use of its framework by these actors.<\/p>\n

The framework leaves behind a recognizable shape. Every Uni-App project, by default, ships with a handful of shared resources; none of them are inherently malicious. They are simply the default scaffolding that every Uni-App project includes when it is built, the way every WordPress site shares certain underlying file paths, and every React app ships with a recognizable build artifacts.<\/p>\n

There are likely threat actors selling DCloud investment scam templates, but we\u2019ve also found indications of centralized ownership across huge swaths of DCloud investment scam websites. Beyond the technical connections, we also uncovered patterns in the growth of the DCloud investment sites, along with coordinated dips in new domain registrations seen across scam websites on diverse hosts, an indication of a centralized owner facing disruption or making coordinated changes across all their DCloud investment scam sites.<\/p>\n

From RainbowEx to a Much Larger Ecosystem<\/h3>\n

The RainbowEx exchange that swept San Pedro was hosted primarily on just one website (rainbowex[.]cc). Investigators who looked at its code in late 2024 quickly realized it had been built on the DCloud Uni-App framework, and this detail made its way into early news reports and then eventually into the huge New York Times article \u201cHow a Crypto Craze Swept An Argentine Town<\/a>.\u201d <\/p>\n

Infoblox Threat Intel undertook a research process to use technical fingerprints common to sites built on the DCloud framework. We identified a large population of domains\u2014hundreds of thousands of them\u2014that are both using DCloud and conducting a wide range of scams. Use of DCloud itself is not, on its own, evidence of malicious intent. Legitimate developers ship sites with it too. What separates the malicious population from the legitimate one is what gets layered on top of the framework: fake brokerage interfaces, cryptocurrency wallet-drainer prompts, gambling interfaces with rigged outcomes, brand-impersonation storefronts, and the rest of the modern online-fraud playbook.<\/p>\n

We were able to develop additional technical fingerprints to filter out the known malicious DCloud websites from the generic sites. The scam website found using DCloud also had a small portion that attempted to remove DCloud fingerprints, and our data showed these evasive websites were hosted on more bulletproof hosting (BPH) providers than the vanilla scam sites, indicating greater sophistication by some of the actors using this framework. <\/p>\n

After filtering out legitimate enterprise customers of the DCloud framework (large platforms, multi-tenant SaaS, established Chinese businesses) we identified over 236,000 distinct second-level domains<\/strong> (SLDs) that appear to have been operated for fraudulent purposes since 2022. These domains span every continent, target speakers of at least eight languages, and impersonate brands ranging from major stock exchanges to retail giants to messaging platforms.<\/p>\n

And when we look at the broad scope of this data, there are trends that indicate centralized operators behind many of the investment scam websites.<\/p>\n

The Scale of the Investment Scam Population<\/h3>\n

Across the focused investment scam collection (the population shown in Figure 1 below), Infoblox has analyzed:<\/p>\n