After I tried logging to my host's cpanel today, I got the safe browsing warning, about the site "redirecting users to harmful websites".
The cpanel uses an address like this: https://subdomainXX.host.com:8443/
Each subdomainXX is a different VPS providing by the host company.
The address subdomainXX.host.com isn't used for anything else other than the cpanel access (afaik). Indeed, searching for it in Google using the site: operator returns 0 results.
However, searching for site:host.com, returns several infected sites. The other sites are located at different IPs (and I presume different VPS)
This answer seems to suggest that it has happened before, but it's just a guess, with no authoritative documentation.
Does Google flag all subdomains for malware/phishing if one is infected? (source/documentation if possible) If yes, how can a host be protected from such (mis)use?