Coordinated global operation by Europol shuts down over 373,000 fraudulent websites on the dark web

A global operation coordinated by German authorities and supported by Europol has led to the closure of over 373,000 fraudulent websites on the dark web, the identification of the network operator, and the opening of investigations against hundreds of individuals suspected of attempting to purchase child sexual abuse materials or other criminal services promoted online.

In short

Operation Alice took place between March 9 and 19, 2026, with the participation of authorities from 23 countries.

The investigation started from a platform on the dark web and led to the discovery of a network of over 373,000 fraudulent onion domains.

The network operator, a 35-year-old man located in the People's Republic of China, is suspected of having obtained over 345,000 euros from approximately 10,000 clients worldwide.

440 clients have been identified, and investigations continue in the case of over a hundred of them.

As part of the operation, websites were shut down, 105 servers were confiscated, and electronic devices were seized, including computers, mobile phones, and data storage devices.

The investigation began in mid-2021 and initially targeted the dark web platform "Alice with Violence CP." During the investigation, authorities discovered that the platform operator managed a much larger network, consisting of hundreds of thousands of fraudulent websites promoting child sexual abuse materials and offers of cybercrime-as-a-service.

According to the investigation's findings, between February 2020 and July 2025, the suspect promoted child sexual abuse materials accessible through over 90,000 of these onion domains on various platforms. On these websites, users were promised access to so-called "packages" of content after providing an email address and making a payment in Bitcoin.

The packages were estimated to cost between 17 and 215 euros and promised data volumes ranging from a few gigabytes to several terabytes. In reality, investigators say the websites were purely fraudulent. The content was displayed and promoted but was never delivered to buyers.

Alongside these offers, the network also promoted on-demand cybercrime services, including bank card data and access to external computer systems. The goal was the same: to convince customers to make payments without receiving any service in return.

The network operator is described by authorities as a 35-year-old man from the People's Republic of China. The investigation estimates that he obtained over 345,000 euros from approximately 10,000 clients worldwide. From November 2019 until recently, he allegedly operated an infrastructure that peaked at 287 servers, of which 105 were located in Germany. German authorities issued an international arrest warrant.

The operation did not only target the operator. Based on the data obtained, investigators identified 440 clients who used his services. Due to the nature of the purchases, authorities opened additional investigations against these individuals. Investigations are still ongoing in the case of over a hundred of them.

Authorities emphasize that the mere fact that the promised materials were not delivered does not eliminate criminal suspicions regarding the buyers. According to the investigation, individuals who paid to gain access to exclusive and serious child sexual abuse materials have themselves become suspects and are considered key targets for law enforcement investigations.

Throughout the investigation, authorities intervened immediately whenever they identified children in danger. In one example mentioned by investigators, in August 2023, the criminal police in Bavaria searched the home of a 31-year-old father who had transferred 20 euros to purchase a package promising 70 GB of such materials. The man was subsequently convicted.

Europol played a coordinating and operational support role. The agency facilitated the exchange of information between national authorities, provided analytical support, and coordinated the international response. Additionally, Europol specialists played an important role in tracking cryptocurrency payments and providing operational information to the involved states. According to the agency, the close cooperation between German authorities and Europol was essential for identifying the main perpetrator.

Europol's Executive Director, Catherine De Bolle, stated that "Operation Alice sends a clear message: there is nowhere to hide for criminals when the international law enforcement community works hand in glove. We will find them and hold them accountable. Europol will continue to protect children, support victims, and track down the perpetrators." In the Romanian version, the message is that Operation Alice clearly conveys that criminals have nowhere to hide when law enforcement authorities cooperate closely at the international level, that they will be found and held accountable, and that Europol will continue to protect children, support victims, and pursue the perpetrators.

The operation's results include identifying a main perpetrator operating the platform on the dark web, identifying 440 clients, closing over 373,000 dark web sites, confiscating 105 servers, and seizing electronic devices and data storage.

The list of participating states includes several EU member countries, as well as third countries, including Australia, Canada, the United Kingdom, the United States, Switzerland, and Ukraine. Romania's participation is mentioned among the countries involved in the operation.

The broader context of this case is related to the increasing use of hidden infrastructures on the dark web for fraud, distribution of illegal content, and on-demand criminal services. The case shows that such networks can combine multiple forms of digital crime, from online fraud and cryptocurrency payments to offers targeting extremely serious forms of child exploitation.

In parallel, Europol has also insisted on the terminology used in public communication, calling for the avoidance of the term "child pornography" and the use of the phrase "child sexual abuse material," arguing that each image or recording captures a real situation of abuse and cannot be treated as pornography.

The operation also highlights the preventive and protective dimension of such investigations. Beyond shutting down fraudulent infrastructure and identifying suspects, authorities have emphasized the need for rapid intervention in cases where there are indications of children in danger and for supporting victims.

https://2eu.brussels/ro/stiri/operatiune-globala-coordonata-de-europol-inchide-peste-373000-de-site-uri-frauduloase-pe-dark-web