Research to better understand, document, and protect against phishing is of course desirable, but I would echo the previous answer that at the domain level this is probably impossible without doing content analysis, because it amounts to proving a negative, complete information for which does not exist.
It is probably possible to analyze a corpus of privacy policies and determine which ones suggest the presence of user-generated content, but that maps only to businesses, not to domains.
Generating the full listing of domains and subdomains in the possession of a business is an art, as that information is not expressly public and has to be guessed at or inferred. In the context of a specific domain, a given policy may apply to many domains in the possession of the business that is ultimately accountable for the policy, and not necessarily apply specifically to the domain under which it is hosted.
Many many sites of course traffic in ads, which are a major phishing and malware delivery vehicle. One may even exhaustively crawl a site to determine whether it serves ads, but if it determines a bot is visiting, it may decide not to deliver ad tags to that particular client because doing so will have an impact on metrics important to ad delivery and revenue.
Phishing sites can be hidden behind layers of URL shorteners, and these also can make decisions in real time about what link to deliver to what visitor, so even the presence of links in UGC is not necessarily a straightforward indicator.
Finally, in the context of popularity- google.com ABSOLUTELY can host phishing content, because user-generated content is returned in search results served under the google.com domain.