No, the screen w/ "Google stopped this sign in attempt" is not from Google. Presumably the "Change Password" link pointed to a server controlled by the phishers.
Why would the phishers inform the victim that they got his password? It's against their goals.
Edit: Fascinatingly, the google.com/amp does the redirection, but the google.com is contacted first. Why would google.com do this? Ah, yes... the Google validated AMP cache. Nice.
Edit2: Dude in the reply to this, the fascinating thing is, the google.com is actually contacted from that address first. Mind blown. The phishing using the actual, real google.com. Really, really, nice. That is for me the most fascinating detail from this whole story. It is actually the real www.google.com who made that thing possible. Wow.
The fact that Google actually sends out emails that look like that is what makes the phishing attack so effective. The email looks like it is from Google, and therefore trustworthy.
As to why the phishers would inform him that they got his password? The reason is that at the time they sent the phishing email, they didn't actually have his password, and wanted him to click on a link that they controlled so he would give them his password.
I'm trying to get through to you. Please tell me it's working.
Google's official policy regarding open redirectors: "Our take on this is that tooltips are not a reliable security indicator, and can be tampered with in many ways; so, we invest in technologies to detect and alert users about phishing and abuse, but we generally hold that a small number of properly monitored redirectors offers fairly clear benefits and poses very little practical risk." [2]
[1] http://seclists.org/bugtraq/2016/Apr/70
[2] https://sites.google.com/site/bughunteruniversity/nonvuln/op...
Translation: "we don't look at that sh.t"
> "poses very little practical risk."
I'm sure Powell, Podesta and a big part of the world now clearly agree with them. /s
Everybody knew t.co/sh.t is somewhere else. www.google.com/whatever/without/query wasn't. Fracking up the established expectations.
> "offers fairly clear benefits"
Translation "For us. Muahhaha."
At least, until something like this. Hopefully.