[mothered]

They're US-based (west coast) servers.

Hosting in US is probably a bad idea for OP, not that I would recommend breaking the law. I'd probably vouch for your hosting, but for what he's wanting he'd only be a subpoena away from catching a felony.

He should be fine if he's targeting a specific person, or small group of people.  But for large scale, then yeah, someone will take notice.

Generally speaking, yes.

However (as opposed to offshore hosting), US law may Impose harsh penalties for acts of phishing that's clearly not permitted.