[Animats]

Google is at the top of SiteTruth's list of major sites currently being exploited by phishing scams. 37 of them right now.[1] This list comes from a join of PhishTank and Open Directory - sites with some reasonable reputation and an active report in PhishTank. At one time, Microsoft and Yahoo were at the top, but they got better.

Any popular free hosting service ends up hosting phishing sites, but Google doesn't aggressively clean them out. Here's Google's oldest phishing site, from 2010.[2] It's an attempt to steal Habbo logins (Habbo is an old virtual world, similar to The Sims.) Lately, phishing via Google Drive is picking up. Phishing sites hosted on Google Spreadsheets have finally disappeared; you can put HTML in a spreadsheet cell and host a site that way. For a long time, Google didn't recognize that this was a way to host a fake site.

At least all the fake sites are under Google's subdomains (sites., drive., etc.) There used to be exploits using "google.com" as an open redirector.

[1] http://sitetruth.com/reports/phishes.html [2] https://sites.google.com/site/freehabbocoinsgbbo00/