Millions of scam sites use characters that look like English letters, research into international domains reveals.