Just checked the malicious link again.

It looks like Google removed (at least one of) their access tokens

Checked the URL containing:

  googledocs.g-docs.win%2Fg.php