For example gmail is on google.com, so is google drive, google transalte (I think this might be a big one), and various other services that host user content.
Someone briefly had a pointer to http://www.google.com/safebrowsing/diagnostic?site=code.goog..., which includes:
> Malicious software is hosted on 23 domain(s), including sms-bomber.googlecode.com/, gdata-issues.googlecode.com/, infojob.googlecode.com/.