Work for a registry with many TLDs. Shut down is removing NS records from the TLD zone. And yes, you can generally report this type of thing to a registry of a TLD. We often act quicker than many registrars, in my experience(though it depends on a TLDs owner/policies...some are much better wrt malicious activity than others).