I reckon scam sites pretending to be reputable newspapers and mimicking their layout and contents to push investment scams via social media ads should qualify.

And heck, any and all phishing sites, by definition.

So millions of websites?