Scammers want to steal your passwords and financial data with fake websites. But where do they host them, and how to spot a fake?