Not attempting to excuse their lack of action, but there are cases where it's somewhat understandable why a registrar may not take action. For instance, if the

Not attempting to excuse their lack of action, but there are cases where it's somewhat understandable why a registrar may not take action. For instance, if the only service they're actually providing is registration, the domain belongs to a long time customer, and they aren't hosting the site or dns, they're only left with one very blunt action they can take. It's frustrating for sure, but registrars are very hesitant to take such harsh action on long-standing customers. In that example the domain is likely compromised though, so you need to be reporting to all the hosting providers involved as well and not just the registrar.