- Investigators across 23 nations just took down a sketchy dark web operation that falsely claimed to monetize sexual abuse content of children and cybercrime services.
- The bad actor is 35 years old and a Chinese national managing over 373,000 fake websites, realizing $400,000 from nearly 10,000 victims across the world.
- Authorities identified 440 people that use the platform, and an additional 100 users are still under active investigation.
Europol announced on Friday that law enforcement authorities from 23 countries joint force to dismantle a dangerous platform on the dark web that falsely marketed child abuse content as well as internet crime services.
The operation blew open a huge virtual currency scam as well as an international network of individuals actively trying to buy illicit content online.
One Man manages 373,000 Fake Websites for Bad Activities
German investigators deployed “Operation Alice” in 2021, initially focusing on a single platform on the dark web, “Alice with Violence CP.” According to discoveries, a 35-year-old Chinese national had built and managed over 373,000 hidden websites, all with the intention of personating illegal marketplaces promoting child abuse materials, hijacked credit card details, and access to hacked computer systems.
The sites showed excerpts of illegal materials and offered packages marked up to €215, equivalent to $248. It promised data volumes ranging from several gigabytes (GB) to terabytes (TB).
The customers paid via virtual currency and none of them got what they paid for. The platforms served one purpose, extracting money from individuals trying to purchase illicit material.
Between February 2020 and July 2025, the perpetrator ran this operation none-stop and at significant scale. At its highest point, the network depended on up to 300 servers, with more than a third of them based in Germany.
According to investigators’ estimate, the suspect took approximately $400,000 from roughly 10,000 customers from all over different countries. For a long time, German prosecutors have issued a warrant for international arrest.
440 Users Pinpointed as Investigation Widens
The takedown did not end with the operator. Authorities widened the investigation earlier this month and fished out 440 persons who had visited the platform. More than 100 of them are under active scrutiny, officials confirmed.
Law enforcement agencies stressed a critical legal point: customers who never received the illegal content are not exempt from prosecution. Attempting to purchase child sexual abuse material constitutes a criminal offense in many jurisdictions, regardless of whether the transaction actually succeeded. The act of paying for it is enough.
Investigators also see these identified users as significant intelligence assets. “Individuals seeking access to exclusive and severe material can represent high-value targets,” officials noted, adding that pursuing such cases helps map broader criminal networks operating across the dark web. Each user represents a thread that investigators can pull to uncover further criminal activity.
International Cooperation Sends a Direct Warning
Operation Alice brought together law enforcement from 23 countries, a scale of coordination that Europol director Catherine de Bolle described as essential to confronting modern cybercrime.
“Criminals can’t hide when international authorities unite. We will fish them out and hold them responsible,” de Bolle said in a statement.
The case exposes two distinct problems operating side by side. Sophisticated fraudsters exploit the demand for illegal content to run large-scale scams, collecting cryptocurrency from thousands of willing buyers while delivering nothing. Simultaneously, those same buyers actively sought child sexual abuse material, which is itself a crime.
By targeting both the operator and the users, Operation Alice strikes at both ends of the problem. Investigators dismantled the infrastructure, traced the suspect, and simultaneously built a list of individuals whose online activity crossed into criminal territory.
The operation also exposes the limits of dark web anonymity. The suspect ran more than 373,000 websites over five years, yet investigators still traced the servers, followed the cryptocurrency payments, and identified the man behind the entire network.
For the 440 flagged users, consequences are still unfolding. A recent arrest in Madisonville, Kentucky for purchasing child abuse material from the dark web shows that buyers are being identified and prosecuted as well, a warning to the 440 flagged users that their activities may also lead to criminal charges.
Authorities say the investigation continues, and more names may surface as forensic teams work through seized data and transaction records.
