A billion scam messages came from three shops. Microsoft just seized their domains.

If you have ever had a text about a parcel stuck at a depot, a parking fine you do not remember, or a bank needing you to confirm something right now, there is a fair chance the page behind it came out of a shop. Not a metaphor. An actual shop, with a catalogue, prices and customer support.

On 14 October Microsoft's Digital Crimes Unit, working with Japan's National Police Agency and the healthcare group Health-ISAC, used a US court order to seize the domains behind three of them: YAM Store, CoGUI and Iron Man. Microsoft's figure is that since January these three helped send more than a billion phishing emails and text messages, impersonating over 75,000 organisations across more than 150 countries. Over 20,000 accounts tied to YAM Store were disabled and more than 100,000 impersonation domains are being blocked.

The product list is the part worth reading. Iron Man shipped with more than 2,335 ready-made lure pages covering 139 countries: Amazon, Australia Post, Medicare, traffic and parking authorities, police forces, Japanese banks. Whatever sounds plausible where you live, somebody had already built the page. And these were not static copies. When a victim typed a password, the operator got a Telegram notification and could ask for the verification code live, while signing in as them on the real site.

Takedowns like this buy months rather than years, and the crews behind them rebuild. What does not change is the shape: a message you were not expecting, a deadline, a link to a login page. Open the app or type the address yourself and the whole business model stops working. Tendvane's health score gives you one pass over the rest of the basics, including whether Windows protections and disk encryption are where they should be.