Google App Engine lets you create unlimited subdomains for phishing pages

and malware C&C server to make it hard for corporate security solutions to implement IOC/domain-based blocks.