Operation Alice Exposes Fraudulent CSAM Platform
On 9 March 2026, a global operation led by German law enforcement authorities and supported by Europol targeted a major dark web network known as "Alice with Violence CP". Taking place from 9 to 19 March across 23 countries, the operation initially focused on the platform operator but ultimately resulted in the identification of hundreds of customers, prompting further investigations.
Over the last five years, investigators discovered that one individual had operated over 373,000 onion domains on the dark web. Over 90,000 of these domains advertised child sexual abuse material (CSAM), offering paid "packages" via email registration and Bitcoin payments, but the advertised content was never delivered. The sites also promoted other fraudulent "cybercrime-as-a-service" offerings with the same goal of obtaining payment without delivery.
The operation identified one main suspect, a 35-year-old man based in China, shut down over 373,000 websites, seized 105 servers, and identified 440 customers worldwide.