I’ve had mixed success in the past reporting their domain to their domain registrar (which you can find on who.is, whois.com, etc.). Except companies like GoDaddy don’t check their abuse email and make you use their ticketing system which just says that they don’t care about scams. But they’ll just register new domains