Researchers have found that criminals are using mainstream ISPs, hosting companies, and free internet services in phishing and domain spoofing scams, especially when major events are around.