Many of those are long gone, but PhishTank hasn't cleaned them out, so they're still listed.
[1] http://www.sitetruth.com/reports/phishes.html [2] http://www.sitetruth.com/fcgi/ratingdetails.fcgi?details=tru...
I run the service at https://urlscan.io which tracks phishing and frequently run into these cases which render any kind of black/whitelisting impossible. Imagine Microsoft phishing hosted on Microsoft domains and infrastructure. Here's a fun search which will return lots of phishing on windows[.]net and googleapis[.]com: https://urlscan.io/search/#page.domain%3A(googleapis.com%20O...
The big difference here is that all the other platforms struggling (and failing too often) to prevent themselves being used as phishing hosting - aren't then turning around and hypocritically taking other platform's entire internet presence offline for doing so.
Google here are acting in the roles of judge and executioner, while being the biggest offender of the same crime.
I used to contact nonprofits and small businesses which showed up on that list. Inevitably,they'd had a break-in. With some nagging, I could cut the size of the list in half.
I find that a lot of phishing sites these days are hosted on legitimate sites that have been backdoored, but are continuing to operate as normal.
The phishing page is hidden away in the /.well-known/ directory or another similar one, so the website owner is non-the-wiser.