Bingo. Protect the users first. For example, you can report the websites to Google Safebrowsing: https://safebrowsing.google.com/safebrowsing/report_phish/
Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false