Start with the ISP

In the case of phishing sites, surely the first defence should be that the ISP running the phishing site has an 24 hours per day instant take-down obligation, so that the moment one user detects a scam the ISP verifies it and prevents anybody else from being caught by it.

Of course, that requires international enforcement of that obligation, and maybe one or two nations will fail to pass the necessary legislation -- so it has to be backed up by a further procedure where cooperative ISPs mutually block access to detected phishing pages of uncooperative ISPs.