A domain has several control layers
The registrar, DNS provider, CDN, host, browser blocklist, and search engine each control a different part of the user journey. An effective escalation identifies the provider that can act on the specific abuse rather than sending the same notice everywhere.
Evidence is preserved first because malicious sites often move providers, hide behind reverse proxies, or disappear temporarily after detection.