Authorities from 23 countries participate in the operation
On 9 March 2026, a global operation led by German authorities and supported by Europol was launched against one of the largest networks of fraudulent platforms in the dark web. The investigation began in mid-2021 against the dark web platform “Alice with Violence CP”. During the investigation, authorities discovered that the platform’s operator was running more than 373 000 fraudulent websites advertising child sexual abuse material (CSAM) and cybercrime-as-a-service (CaaS) offerings.
From 9 to 19 March 2026, 23 countries joined forces in 'Operation Alice,' which initially only targeted the platform operator. However, through international cooperation, the investigation uncovered the identities of 440 customers who had used the operator's services. Due to the nature of the purchases, additional investigations were launched against them. The operation is still ongoing against more than a hundred of those individuals.
Results of Operation Alice
So far, Operation Alice has led to the following results:
- 1 perpetrator operating the dark web platform identified;
- 440 customers worldwide identified;
- Over 373 000 dark web websites shut down;
- 105 servers seized;
- Electronic devices seized, including computers, mobile phones and electronic data carriers.
Catherine De Bolle
Europol’s Executive Director
Operation Alice sends a clear message: there is nowhere to hide for criminals when the international law enforcement community works hand in glove. We will find them and hold them accountable. Europol will continue to protect children, support victims, and track down the perpetrators.
An intricate network of fraudulent websites
Over the course of nearly five years of investigation, German authorities discovered that a single individual operated more than 373 000 onion domains (websites) on the dark web. An onion domain is a special type of website address that is designed to hide the identity and location of the website and the people visiting it. From February 2020 to July 2025, the suspect advertised CSAM on different platforms, which were accessible through more than 90 000 of those onion domains. On these platforms, the perpetrator offered CSAM that could allegedly be purchased as “packages” after providing an email address and making a payment in Bitcoin.
Each package had an estimated cost of between EUR 17 and EUR 215, and promised data volumes ranging from a few gigabytes to several terabytes of CSAM. However, these were purely fraudulent sites where CSAM was advertised and previewed but never delivered.
In addition to CSAM, several cybercrime-as-a-service (CaaS) offerings were promoted, including credit card data and access to foreign systems. The goal was always to persuade customers to make payments without receiving any service in return.
Targeting the operator…
Investigations were also conducted against the platform’s operator, a 35-year-old man based in the People's Republic of China. Authorities estimate that the individual made over EUR 345 000 in profit from approximately 10 000 customers worldwide who, according to authorities, attempted to purchase the material he was advertising.
From November 2019 until recently, he operated a network of up to 287 servers at its peak, 105 of which were located in Germany. German authorities have issued an international arrest warrant.
…the criminals purchasing CSAM…
By paying for CSAM, the customers themselves became suspects, even though they never received the material. Investigators assessed that individuals seeking access to exclusive –and, therefore, severe– child sexual abuse material could represent high-value targets and provide important intelligence for law enforcement worldwide.
…and protecting the victims
Throughout the years of investigation, authorities acted immediately whenever they identified children to be in danger, taking appropriate measures to protect their well-being.
For example, in August 2023, investigators from the Bavarian State Criminal Police Office searched the home of a 31-year-old father who had transferred EUR 20 to purchase a package containing 70 GB of CSAM. The man was later convicted.
Europol’s role
During the investigation, Europol specialists facilitated the exchange of information between national authorities, provided analytical support and coordinated the international response. Additionally, they played a key role in tracing cryptocurrency payments and delivering intelligence to the countries involved in the operation.
Most importantly, the close cooperation between German authorities and Europol enabled the identification of the perpetrator.
Stopping child abuse and supporting victims
The fight against child sexual exploitation is a priority for Europol. Alongside the support provided by the European Cybercrime Centre (EC3) to Member States in preventing and detecting crimes linked to the sexual exploitation of children, Europol is currently running two major projects in this area.
This week, Europol released new photos to the platform 'Stop Child Abuse – Trace an Object', which calls on all citizens to examine objects from child sexual abuse cold cases and see if they recognise any of them. No clue is too small: even the smallest detail could help identify and safeguard a sexually abused child.
Additionally, a new digital platform, Help4U, was launched in November 2025 to support children and teenagers facing sexual abuse or online harm. Designed to be simple, private and accessible, Help4U helps young people find trusted advice, understand their rights and connect with people who can help them.
Participating countries in Operation Alice:
- Australia: Australian Federal Police (AFP)
- Austria: Criminal Intelligence Service (Bundeskriminalamt)
- Belgium: Federal Judicial Police – Federale Gerechtelijke Politie
- Canada: Royal Canadian Mounted police (RCMP) - National Child Exploitation Crime Centre (NCECC)
- Croatia: National Cybercrime Department (Služba kibernetičke sigurnosti)
- Czech Republic: Czech national police (USKPV), Bureau of Criminal Police and Investigation Service
- Denmark: National Cyber Crime Centre (NC3) at Special Crime Unit (SCU/NSK) and Danish National Police (Dansk Politi)
- France: Police department for the protection of children (OFMIN) of the national directorate of judicial police (DNPJ)
- Germany: Bavarian State Criminal Police (BLKA), Bavarian Central Office for the Prosecution of Cybercrime (ZKI), Federal Criminal Police Office (BKA)
- Hungary: National Bureau of Investigation Cybercrime Department Investigative Division (Nemzeti Nyomozó Iroda Kiberbűnözés Elleni Főosztály Nyomozó Osztály)
- Italy: National Police – Postal and Cyber Security Police Service (Polizia di Stato - Servizio Polizia Postale e per la Sicurezza Cibernetica)
- Lithuania: Lithuanian Criminal Police Bureau (Lietuvos kriminalines policijos biuras)
- Netherlands: National Police (Politie)
- Poland: Central Cybercrime Bureau (CBZC)
- Portugal: Judicial Police (Polícia Judiciária)
- Romania: Romanian Police (Poliția Română)
- Slovenia: Slovenian Criminal Police (Slovenska kriminalistična policija)
- Spain: Guardia Civil - Criminal Intelligence Unit (UTPJ) and Central Investigations Unit (UCO)
- Sweden: National Cybercrime Centre (SC3), Region South (Syd), Region West (Väst) and Region Bergslagen
- Switzerland: Federal Office of Police fedpol (Bundesamt für Polizei fedpol), Lucerne Police (Luzerner Polizei), Cantonal Police of St. Gallen (Kantonspolizei St. Gallen), Cantonal Police of Thurgau (Kantonspolizei Thurgau), Cantonal Police of Zurich (Kantonspolizei Zürich)
- Ukraine: National Police of Ukraine
- United Kingdom: National Crime Agency (NCA)
- US: Homeland Security Investigations (HSI)
Note to media
Europol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting.
The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.
.jpg)
