it appeared after sha1, receives less attention than sha1, and is slower than sha1... so why use it at all?
Many use it because it wasn't developed by the NSA. It is a default in TrueCrypt, for example.
It's used in Bitcoin as well (after SHA-2) to shorten up addresses. Come to think of it, I think Tor uses it for .onion addresses... which they shorten to 80 bits (of preimage resistance!)