Significantly more than half of the phishing attempts I see now come from #Google email servers (as proven by the top Received: header line), typically #Gmail.

Significantly more than half of the phishing attempts I see now come from #Google email servers (as proven by the top Received: header line), typically #Gmail. An even larger percentage of the payloads (e.g. "click this link") for these -- closer to 75% these days -- point to GCP (Google Cloud Platform) instances (e.g. via googleapis.com). Google puts a lot of effort into detecting incoming spam and phishes (with varying success) but has become a veritable firehouse of such garbage sent to non-Gmail addresses.