Genome signatures.
Cloned scams, tagged.

DOM hashes, JS topology, favicon SHA, content fingerprints, each signal is a code or content pattern shared across fraudulent platforms.