Hundreds of subdomains from dozens of universities have been hijacked by scammers.