From San Pedro to Salinas: How a Chinese Framework “DCloud Uni-App” Powers a Global Scam Economy

This report exposes a global, large-scale investment-scam ecosystem built on the DCloud Uni-App framework: a shared template family powering fake exchanges, wallet drainers, scam gambling sites, and messaging phishing that have launched over 236,000 suspicious second-level domains since 2022. It maps technical fingerprints, hosting patterns (major cloud providers and a bulletproof-hosting segment centered on CTG Server), operator clustering and evasive behavior, enterprise DNS exposure (~5M queries across ~985 customers), and concrete real-world fraud examples (RainbowEx in Argentina, LSSC and Yuechi in the U.S./ANZ), and provides representative domain indicators and defensive guidance for DNS-layer blocking and targeted awareness.