An international law enforcement operation took down a phishing-as-a-service website that security researchers say was responsible for more than 150,000 phishing domains.

Authorities in Indonesia arrested the site’s alleged administrator and another man, while Japanese police arrested an additional suspect, Interpol announced Tuesday.

The site, 16shop, has been in existence since at least 2017. It sold phishing kits that targeted more than 70,000 people across 43 countries including victims in Germany, Japan, France, the Untied States, the United Kingdom and Thailand. The kits contained malicious scripts allowing cybercriminals with modest programming skills to quickly deploy large volumes of phishing pages, said cybersecurity firm Group-IB, which supplied technical expertise to the investigation.