You're right, geti, it's quite common for phishing websites to be hosted on hacked hosting accounts.
Not long ago I was going through an old back-up of one of my sites, when I found a fold I didn't recognise - and you've guessed it, in there was a phishing page. Someone had hacked my site just to upload a phishing attack.
When surprised me is that I never knew about it - even the backup was an old version.
A danger, I guess, of leaving insecure script installs on your hosting, I guess - and the bane of webhosts everywhere.
