> Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised).
Well, they are already compromised. If they were lucky, it was just an automated system that scanned for vulnerabilities and only dropped the phishing webserver – for now. It could be used as a jump box to compromise further systems in the host's network. Who knows what else may be running in the box. If it is being used for 'legitimate purposes', whatever purpose it is, it is at a large risk.
The fact that it is still compromised indicates that it is not actively/properly monitored.
Taking it out will draw much more attention to the system from their owners. If I had a compromised system that I didn't know about and it was taken out, I'd be thankful it wasn't left running for longer.
It's not the 'correct' thing to do, but I'm not convinced that putting the system out of comission is more harmful than leaving it running doing who knows what.