Sophos has posted an article on their blog about a fake Google webpage that they have encountered.

There are pictures that are included in the source link below. As you can see, the webpage looks very similar. The top part of the webpage looks different. The legitimate site has links on the top left and right side of the webpages. The fake site only has links on the top right of the webpage.

Besides that difference, Sophos also posted the source code of the webpage. They noted that it contains a JavaScript script. The script attempts to exploit a browser vulnerability which is known as MS06-014. It will download and execute a Win32 trojan.

Source: Sophos