In the case of the attack that's been publicized in the press, the domain is registered to a company in New Zealand. The web site's IP address belongs to a company in Panama. The web sit's IP address geolocates to Russia. They are targeting bank accounts in multiple countries.
How many YEARS would it take before the Slobovian police knock on the perp's door?
These people are clever, and the law will never catch-up with 99+% of them.
It's up to Google to clean it up. Not because of any law or morality - but because it will destroy Google if it gets out of hand.