Operation Alice dismantles 373,000 fraudulent dark web sites
German authorities, backed by Europol and law enforcement partners in 23 countries, launched Operation Alice against a major dark web fraud network built around the platform "Alice with Violence CP". Investigators said a 35-year-old man in the People’s Republic of China operated more than 373,000 onion domains that falsely advertised child sexual abuse material and cybercrime-as-a-service, took payment in Bitcoin, and failed to deliver the promised content. The investigation began in mid-2021 and examined activity spanning November 2019 through July 2025.
Between 9 and 19 March 2026, authorities shut down more than 373,000 dark web sites, seized 105 servers and multiple electronic devices, and identified the alleged operator along with 440 customers worldwide. Officials estimate the scheme generated more than EUR 345,000 from roughly 10,000 customers, while German authorities issued an international arrest warrant and said investigations continue against more than 100 individuals. Europol added that the operation also supported child protection efforts, including immediate interventions where children were found to be at risk and intelligence development on suspects seeking severe CSAM.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
8 events from the most recent confirmed update back to the earliest known activity.
French startup executive ordered to appear in court over Alice case
A French cybersecurity startup executive was implicated in the Alice with Violence CP investigation and is due to appear before the Nanterre judicial court in early September 2026. His lawyer said the three cryptocurrency transactions at issue were test purchases made about four years earlier for research purposes, and investigators reportedly found no evidence he downloaded or possessed illicit content.
Officials say Operation Alice could support 600 prosecutions
Authorities said evidence from Operation Alice could support the prosecution of about 600 offenders and users linked to the fraudulent dark web network. The update expanded the expected enforcement impact beyond the previously disclosed 440 identified customers and more than 100 ongoing investigations.
International arrest warrant issued for suspected operator
German authorities issued an international arrest warrant for the suspected operator, who investigators said earned more than EUR 345,000 from about 10,000 customers worldwide. Authorities also said investigations remain ongoing against more than 100 individuals.
More than 373,000 dark web sites are shut down
Between 9 and 19 March 2026, authorities shut down over 373,000 onion domains tied to the fraudulent network and seized 105 servers along with multiple electronic devices. The takedown was part of coordinated action by 23 countries.
Authorities identify operator and 440 customers
During the operation, investigators identified the suspected operator and 440 customers worldwide connected to the network. Europol said the case also generated child protection interventions and intelligence on suspects seeking severe CSAM.
Operation Alice launched against the dark web fraud network
On 9 March 2026, German authorities, supported by Europol and partners from 23 countries, launched Operation Alice targeting one of the largest fraudulent dark web platform networks. The action focused on the operator of “Alice with Violence CP.”
German investigation into Alice with Violence CP starts
German authorities opened an investigation in mid-2021 into the fraudulent dark web platform network later linked to a 35-year-old man based in the People’s Republic of China. The probe ultimately examined activity spanning November 2019 through July 2025.
Fraudulent dark web network begins operating
The platform network known as “Alice with Violence CP” began activity by November 2019, advertising child sexual abuse material and cybercrime-as-a-service offerings and taking Bitcoin payments without delivering the promised content.
Sources
6 references tracked. Mallory keeps watching after this page renders.
" Des transactions tests " : ce patron d’une start-up mis en caus ...
zdnet.fr
Open sourceDark web platforms taken down in international operation | IT Pro
itpro.com
Open sourceGlobal cybercrime crackdown: over 373 000 dark web sites shut down - Authorities from 23 countries participate in the operation | Europol
europol.europa.eu
Open sourceGlobal cybercrime crackdown: over 373,000 dark web sites shut down - DataBreaches.Net
databreaches.net
Open sourcePolice dismantle dark web network exploiting child sexual abuse material | The Record from Recorded Future News
therecord.media
Open sourcePolice take down 373,000 fake CSAM sites in Operation Alice
bleepingcomputer.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Operation Lightning Takedown of SocksEscort Residential Proxy Botnet
An international law-enforcement operation dubbed **Operation Lightning** disrupted **SocksEscort**, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by **Europol** and **Eurojust** and assisted by private-sector partners **Lumen’s Black Lotus Labs** and the **Shadowserver Foundation**, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by **AVRecon** (Linux) malware. Officials said SocksEscort advertised access to roughly **369,000 IP addresses** since 2020, with Europol stating the infrastructure compromised **369,000+** routers/IoT devices across **163 countries** and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about **8,000 infected routers**, including roughly **2,500 in the United States**. During the coordinated action, authorities **seized 34 domains and 23 servers** across **seven countries**, replaced the service’s website with a seizure notice, and the US froze approximately **$3.5 million in cryptocurrency** tied to the operation; officials also cited the service’s payment platform receiving about **$5.8 million** from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of **ransomware**, **DDoS**, and distribution of **CSAM**—with US reporting citing specific victim losses (including a **$1M** cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly **124,000 users**) will be used to pursue follow-on investigations into both operators and customers of the proxy service.
Mar 24, 2026
German and Spanish Police Dismantle Crimenetwork Marketplace
German and Spanish authorities dismantled the relaunched **Crimenetwork** criminal marketplace and arrested its suspected operator in Mallorca, according to Germany’s Federal Criminal Police Office (BKA) and subsequent reporting. Investigators identified the suspect as a 35-year-old German national accused of rebuilding the platform shortly after the original Crimenetwork was shut down in December 2024, then operating it as a major German-speaking underground market for stolen data, narcotics, forged documents, and other illicit services. Authorities said the platform had more than **22,000 users** and over **100 vendors**, processed payments in cryptocurrencies including **Bitcoin**, **Litecoin**, and **Monero**, and generated more than **€3.6 million** in revenue. The operation was led by the **BKA**, the Frankfurt am Main Public Prosecutor’s Office’s **ZIT**, and the Spanish National Police; investigators also preliminarily seized about **€194,000** in assets and obtained user and transaction data that is expected to support follow-on investigations into vendors, buyers, and related criminal activity.
May 13, 2026
Operation PowerOFF Disrupts DDoS-for-Hire Services and Identifies 3 Million Accounts
Authorities from 21 countries carried out a coordinated Operation PowerOFF crackdown against **DDoS-for-hire** infrastructure, dismantling booter services used to launch attacks against online marketplaces, telecommunications providers, and other internet-facing services. The action resulted in **53 domain takedowns**, **4 arrests**, and **25 search warrants**, while investigators seized servers, infrastructure, and databases tied to the illegal platforms. Data recovered during the operation helped investigators identify **more than 3 million criminal user accounts**, and law enforcement sent **over 75,000 warning emails and letters** to suspected users. Europol said the services lowered the barrier to launching disruptive attacks for motives ranging from curiosity and hacktivism to extortion and anti-competitive activity; prevention measures also included removing **more than 100 URLs** advertising booter services from search results, posting blockchain warning messages, and updating the Operation PowerOFF website as the international enforcement effort continues.
Apr 24, 2026