Scam pages hosted on real Google/Microsoft/cloud platforms (sites.google.com, forms, storage buckets); the domain is real but the page is not the brand's.
How to spot it
Brand login or payment page on a generic hosting subdomain
Path or title names the brand, domain is a shared platform
What to do
A real domain proves who hosts the page, not who wrote it. Banks and payroll sign-ins live on the bank's or payroll provider's own domain.
What the real thing looks like
Real Google or Microsoft sign-in pages on their sign-in domains
Try an example
A practice example with fictional companies. Answer it, then see the tells.