The security industry still tends to describe scam infrastructure through the most visible artefact: the malicious website. That framing is convenient because websites are easy to scan, classify, block and remove. It is also operationally incomplete. A modern scam operation is better understood as a distributed service chain composed of acquisition channels, impersonation assets, communication mechanisms, payment pathways, supporting identities, redirectors, applications, phone numbers, soc...