Uncovering Actor TTP Patterns and the Role of DNS in Investment Scams