Groups of numbers, domains, and accounts we've confirmed belong to the same scam operation — not just isolated reports.