Incident Handling for phishing attemts

[sfmailsbm () gmail com]

Hi List,
Just wanted to get a few suggections on how we might handle a phishing attempt?

Some actions I thing abt:
(a) Identify website, and contact owner/isp to take actions
(b) Determine source of mail, and try to identify sender /report to domain ownner/isp

any other "technical" actions that can taken?

What about legal actions? 

Many many thanks
Ron