It's entirely possible for more than one party to be acting in an unscrupulous/undesirable manner in this chain.

On a second thought, yes, you're actually right...

I totally understand Namecheap's response here apart from not visiting the website, which seems lazy even if they have a high volume of reports. Let's examine how a typical phishing campaign works:

1. Fraudster buys a "phish kit" - a crappy PHP script with a skinned login page that emails them credentials

2. Fraudster finds one or more compromised websites (read: small WordPress blogs) and sticks the phish kit there on some new page

3. Fraudster spams a bunch of people with a link to the phish kit

Most of their responses will probably be collected within 24 hours. Most webmasters of exploited sites don't pay attention or have a clue how to remediate issues. This means that it's standard practice to also send phishing reports to registrars and hosting companies in addition to contacting the site's owner and reporting to unified blacklists.

Some phish kits block certain IP ranges to make them harder to detect (e.g. a PayPal phish kit might block PayPal's corp IP range).

How did you arrive at this conclusion? The reputation management company is essentially committing fraud. What they're doing is illegal. How are the 2 situations even comparable?