I am a paying user of Google Workspace, and also run a charity that is a user of Google Workspace with thousands of accounts. The account they were trying to phish was a paid Google Workspace email.