INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Police Operation Alice Takedown Targets 373,000 Dark Web Sites

| 2026-03-23 09:10 LOW LOW DATA BREACH
JSON
Executive Summary
AI-generated
A Europol-backed law enforcement operation, Operation Alice, led to the dismantling of over 373,000 dark web sites advertising child sexual abuse material (CSAM) and cybercrime as a service (CaaS), with the German-led operation running from March 9-19. The likely administrator of one such platform, "Alice with Violence CP", was identified as a 35-year-old man living in China, who made over €345,000 ($396,000) in profits from around 10,000 customers worldwide through his network of up to 287 servers, including 105 located in Germany. The operation involved 22 countries and resulted in the identification of 440 customers, with additional investigations ongoing into over 100 individuals; however, no further information is available on their current status.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation AliceOperation AliceOperation Alice TakesOperation Alice TakesOperation StreamOperation Stream
Target & Sectors
DACH DACH
Incident Timeline
‎August 2023
A 35-year-old Chinese man was identified as the likely administrator of Operation Alice, a dark web site network that generated over €345,000 in profits from approximately 10,000 customers worldwide.
infrastructure 287 servers
The Fraud Scheme in Detail The Chinese suspect is said to have run over 373,000 .onion sites, via a network of up to 287 servers, 105 of which were located in Germany and have now been seized.
infrastructure 105 servers
The Fraud Scheme in Detail The Chinese suspect is said to have run over 373,000 .onion sites, via a network of up to 287 servers, 105 of which were located in Germany and have now been seized.
victims 10,000 users
They estimate he made over €345,000 ($396,000) in profits from around 10,000 customers worldwide who were tricked into buying the content and services he advertised.
financial €345,000 Entities
They estimate he made over €345,000 ($396,000) in profits from around 10,000 customers worldwide who were tricked into buying the content and services he advertised.
‎July 2025
Threat actors used a platform that offered genuine CSAM to over 1.8 million registered users, which was then targeted by Operation Stream in July 2025.
victims 1.8 registered users
The platform had been operating since 2021 and, unlike Alice with Violence CP, offered genuine CSAM to over 1.8 million registered users.
financial €17 € package cost
Each package cost between €17 and €215, with data volumes ranging from a few gigabytes to several terabytes.
‎2026/03/23
International law enforcement, led by German authorities and supported by Europol, launched a global operation on March 9-19, 2026, that shut down over 373,000 dark web sites offering fake child sexual abuse material (CSAM) packages.
infrastructure 287 servers
At its peak, the scam network’s infrastructure comprised 287 servers, with a significant portion (105) located in Germany, all of which have now been seized.
“From November 2019 until recently, he operated a network of up to 287 servers at its peak, 105 of which were located in Germany.
data_breach 70 GB
Authorities acted quickly to protect children at risk, such as a 31-year-old father convicted in 2023 for attempting to buy 70 GB of CSAM.
victims 10,000 users
The fraudulent CSAM platform fooled around 10,000 users into paying roughly $400,000 to the operator of the sites.
financial $400,000 users
The fraudulent CSAM platform fooled around 10,000 users into paying roughly $400,000 to the operator of the sites.
victims 440 users
Of those, the authorities have identified 440 users in 23 countries, and are currently investigating 100 of them.
Over the nearly five years of the investigation, the site and hundreds of thousands of others like it became a useful honeypot for police, enabling them – through international cooperation – to unmask the identities of 440 customers.
The investigation revealed 440 customers worldwide, prompting further probes against them, with ongoing actions against more than 100 individuals.
infrastructure 105 servers
…thorities have identified 1 operator based in the People’s Republic of China, shut down over 373,000 dark web sites, seized 105 servers, and confiscated computers, mobile phones, and other electronic devices, marking a major step against illicit on…
financial €20 father
In August 2023, for example, officers from the Bavarian State Criminal Police Office searched the home of a 31-year-old father who had attempted to purchase €20 ($23) of CSAM.
Tactical Metrics
Metrics
infrastructure
287
Servers
At its peak, the scam network’s infrastructure comprised 287 servers, with a significant portion (105) located in Germany, all of which have now been seized.
The Fraud Scheme in Detail The Chinese suspect is said to have run over 373,000 .onion sites, via a network of up to 287 servers, 105 of which were located in Germany and have now been seized.
“From November 2019 until recently, he operated a network of up to 287 servers at its peak, 105 of which were located in Germany.
Metrics
victims
10,000
Users
The fraudulent CSAM platform fooled around 10,000 users into paying roughly $400,000 to the operator of the sites.
They estimate he made over €345,000 ($396,000) in profits from around 10,000 customers worldwide who were tricked into buying the content and services he advertised.
Metrics
financial
400,000
Users
The fraudulent CSAM platform fooled around 10,000 users into paying roughly $400,000 to the operator of the sites.
Metrics
victims
440
Users
Of those, the authorities have identified 440 users in 23 countries, and are currently investigating 100 of them.
Over the nearly five years of the investigation, the site and hundreds of thousands of others like it became a useful honeypot for police, enabling them – through international cooperation – to unmask the identities of 440 customers.
The investigation revealed 440 customers worldwide, prompting further probes against them, with ongoing actions against more than 100 individuals.
Metrics
infrastructure
105
Servers
The Fraud Scheme in Detail The Chinese suspect is said to have run over 373,000 .onion sites, via a network of up to 287 servers, 105 of which were located in Germany and have now been seized.
…thorities have identified 1 operator based in the People’s Republic of China, shut down over 373,000 dark web sites, seized 105 servers, and confiscated computers, mobile phones, and other electronic devices, marking a major step against illicit on…
Metrics
financial
20
Father
In August 2023, for example, officers from the Bavarian State Criminal Police Office searched the home of a 31-year-old father who had attempted to purchase €20 ($23) of CSAM.
Metrics
victims
1,800,000
Registered Users
The platform had been operating since 2021 and, unlike Alice with Violence CP, offered genuine CSAM to over 1.8 million registered users.
Metrics
financial
345,000
Financial Impact
They estimate he made over €345,000 ($396,000) in profits from around 10,000 customers worldwide who were tricked into buying the content and services he advertised.
Metrics
financial
17
€ Package Cost
Each package cost between €17 and €215, with data volumes ranging from a few gigabytes to several terabytes.
Metrics
data_breach
70
Gb
Authorities acted quickly to protect children at risk, such as a 31-year-old father convicted in 2023 for attempting to buy 70 GB of CSAM.
Intelligence Sources
Infosecurity-Magazine 2026-03-23
Security Affairs 2026-03-23
BleepingComputer 2026-03-20