As I like to say in some other contexts on HN, you must not underestimate the criminal underground. You should not model it as some hacker alone in his basement trying to run scams. You're probably a lot closer thinking of the industry as at least the equivalent of a Dark Google in size and sophistication. If I can imagine a framework where I have a strong set of modular APIs that we can deploy rapidly and put together some prompts for AIs to customize the frontends and graphics hooks so each site looks different, deploying them just like you'd deploy a k8s cluster of these things (and, heck, for all I know, actually being on k8s), the industry as a whole has more than enough firepower to actually implement it. There's an entire dark economy out there where you can outsource parts of this to specialized businesses and get sketchy cloud hosting of all kinds, there's a rich economy around who is taking what actual risks and who gets compensated for them, everything you can imagine.