DOM
106 scam domains share identical DOM structure hashing, indicating cloned website templates or automated generation from the same codebase. This forensic signal strongly suggests coordinated phishing infrastructure operated by the same threat actor or criminal network using identical page layouts across multiple investment/trading-themed fraud domains.
Fingerprint
15618dda36f80a7ff9ad42da4490ad5713f5b3043857a1e32769bb73fb436a97- Detections
- 115
- Hash type
- DOM structure
- Status
- Active
- Last scanned
- May 2026
142026-03
622026-04
392026-05
Detected domains
115activmarkets.org
OnlineTrust 1Mar 24, 2026aiinsightstrends.com
OnlineTrust 1May 25, 2026alphacapital.trade
OnlineTrust 1May 6, 2026alterhillgroup.com
OnlineTrust 1Apr 1, 2026apolloex.org
OnlineTrust 1Apr 19, 2026aropscenter.com
OnlineTrust 1Apr 6, 2026avantrustmarkets.com
OnlineTrust 1Apr 26, 2026axstera.com
OnlineTrust 1Apr 24, 2026basdwin.com
OnlineTrust 1May 11, 2026bastwin.com
OnlineTrust 1May 5, 2026
Related signals
10FA
Favicon #42
Nexus Syndicate
Active
- 81
- detections
FA
Favicon #50
Nexus Syndicate
Active
- 55
- detections
DOM
DOM #47
Nexus Syndicate
Active
- 53
- detections
FA
Favicon #69
Nexus Syndicate
Active
- 38
- detections
BU
Build #70
Nexus Syndicate
Active
- 36
- detections
FA
Favicon #41
Nexus Syndicate
Active
- 23
- detections
DOM
DOM #51
Nexus Syndicate
Active
- 21
- detections
DOM
DOM #89
Nexus Syndicate
Active
- 5
- detections
FA
Favicon #103
Nexus Syndicate
Active
- 4
- detections
DOM
DOM #25
Nexus Syndicate
Active
- 3
- detections