DOM #128

Three distinct scam domains share identical HTML DOM structures, indicating they use a cloned or template-based codebase rather than independently developed websites. This structural uniformity across unrelated brand names (Avatex Swift, Capital Cape, Grawin Holding) is a hallmark of mass-produced phishing or investment scam infrastructure deployed by the same threat actor.