Every provider that touches the internet publishes an acceptable-use policy and staffs, to varying degrees, a desk that enforces it. An abuse report is the request that they enforce it in a specific case. It is not a legal demand, and that is often its advantage: policy enforcement is faster than legal process.
The report succeeds or fails on whether it makes the decision easy. That means the exact URL rather than a domain, a timestamped screenshot, the specific clause of their policy being violated, and proof that the complainant has standing, usually trademark registration or domain ownership.
Providers vary enormously. Large hosts with mature abuse desks often act within hours. Privacy-shielded registrars, offshore providers and bulletproof hosts may never respond at all, and a report to them is a formality on the way to the next layer.
When the first channel goes quiet past its typical window, the escalation options are the upstream provider, a different abuse channel at the same company, the relevant national CERT, or a legal notice. Knowing which one moves a given provider is the operational knowledge that separates a fast takedown from a slow one.
How Fraudox handles it
Phishing site takedown