Study: Top publishers like The New York Times and The Washington Post lose $3.5 million a day to domain spoofing