The preliminary target for complaints is always abuse@ISP, and normally they take abuse seriously enough, however depending on the quality of the ISP. There are also the totally ignorant ones. Making the abuse public is a next step.
Usually the fear of getting a Spamhaus listing is rather efficient, especially if it is a (virtual, multiple-client) server with mail. Then an (x)BL will affect negatively multiple of the ISP's paying customers, which the ISP cannot accept. Does the phishing page send mails? If so, check the "Received from" and mail header, grab the server/IP address, check if it belongs to the same ISP who hosts the phishing page.
- Try to get your hands on the ISP's Terms of Service.
- Create solid evidence of the spammers actions, including screenshots, IP-addresses, dates, etc etc, and prove that the spammer violates the ISP's TOS.
- Send to the ISP's abuse@ email address.
- If that does not help, and if the spamming domain (fake pages) is country-specific, contact that countrys or your local Data Protection Ombudsman, if available, with the same material, and make a complaint. Ask them if the spammer violates the local law. Demand that they contact the (local) spammer or ISP. This may take months, depending on country.
- If the domain is country-specific, contact the authority who manages the domains, and make a complaint. Ask them to cancel the domain address. Not easy.
- If that doesn't help... now it depends on your country. I might try to get in touch with your de-facto spamblogger, who hopefully has further connections to the blocklist keepers, or may give you more specific advice.
- Also: Find out the email address of the ISP's management, and send a complaint there. There is nothing wrong in sending to the CEO, and remember to include as many of the managing personnel as possible, preferrably also include members of the board. This has turned out to be efficient in some cases. Oh, and tell them you will make this public. The word "spam" in the first hit of a google search is a nightmare for the ISP :-).
Edit: Ther scammer will eventually get kicked from the ISP and move over to next, so get ready to repeat. Unfortunately...