I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!

It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.

in this case however both sites I "took down" were still accessible afterwards, they just removed their backend. Still got an empty response or 404 with valid http certificate.

So probably the phishers were annoyed with the fake data and moved servers

If you're in the US, it could be a violation of the Computer Fraud and Abuse Act. I used to do stuff like this until I became aware of the potential felony behind it.

Same for the UK in most cases - illegal.

Probably not, but it's like stealing from a drug dealer. They can't report you without incriminating themselves. Of course stealing from drug dealers is known to have other ramifications...

If they're hosted (e.g. shared hosting), then the hosting party may just lock you out if they had DDOS protection because you're using their resources. They're not happy with phishing sites being hosted on their sites, but also not - and they probably suffer more damage, even if it's "just" resources - from DDOS attacks.

I seriously doubt it is legal in the United States. Seems like a pretty clear abuse of a computer network.

The author lives in Austria and the phishing attempt itself was targeting a major Austrian bank, but I don't know if this is legal or if that's a gray area

Probably as illegal as stealing a cocaine from a drug dealer.

Probably less legal. No court will convict you of stealing that cocaine, but a lot of courts would convict you of computer attack. Don't forget that when attacking, you're almost certainly not attacking just the phisher, but a lot of middlemen.