Europol-Led Operation Dismantles Major Dark Web Child Exploitation Network
In a landmark operation supported by Europol, law enforcement agencies have successfully dismantled an extensive network of over 373,000 dark web sites that were promoting child sexual abuse material (CSAM) and services classified as cybercrime as a service (CaaS). This worldwide effort was spearheaded by German authorities and took place from March 9 to March 19, 2023.
The operation, dubbed "Operation Alice," initially set its sights on a fraudulent platform known as "Alice with Violence CP." This particular platform, which was reportedly operated by a Chinese national, deceived users seeking CSAM and CaaS by convincing them to pay for services that did not exist. The scale of deception is staggering, and the operation has revealed the shocking reach of such criminal enterprises.
Spanning nearly five years, this robust investigation turned "Alice with Violence CP" and countless other similar sites into a valuable honeypot for law enforcement. By facilitating international cooperation among various police agencies, the operation allowed authorities to uncover and reveal the identities of 440 customers engaged with the fraudulent service. Continued investigations are underway for over 100 of these individuals, according to statements released by Europol. Significantly, whenever there were indications that children were in imminent danger, law enforcement swiftly intervened to protect potential victims.
In a related incident in August 2023, officers from the Bavarian State Criminal Police Office executed a search warrant at the residence of a 31-year-old father who was found to have attempted to purchase CSAM valued at €20 (approximately $23). The suspect was subsequently convicted, highlighting the ongoing commitment of law enforcement to tackle such heinous crimes.
The investigation has also pinpointed the likely operator behind "Alice with Violence CP," identified as a 35-year-old man based in China. It is estimated that he generated over €345,000 (about $396,000) from approximately 10,000 duped customers worldwide. In light of the findings, an international arrest warrant has been issued for him, revealing that he has apparently been running this fraudulent scheme since 2019.
The Scale and Mechanism of the Fraudulent Operation
The suspect’s fraudulent activities spanned an extensive array of over 373,000 .onion sites, managed through a vast network comprising up to 287 servers, with 105 of those servers located in Germany and now confiscated by authorities.
From February 2020 to July 2025, he advertised CSAM through various platforms accessible via over 90,000 onion domains. The criminal enterprise offered packages of CSAM for sale, requiring buyers to submit an email address and make payments in Bitcoin. Each package, priced between €17 and €215, contained data that could range from a few gigabytes to several terabytes. Besides CSAM, the individual also promoted CaaS offerings that included stolen credit card data and access to compromised systems. However, despite these advertisements, it appears that the promised services were non-existent; the primary objective was to deceive customers into paying without providing any actual products in return.
The operation received participation from 22 countries, including the United States, the United Kingdom, Ukraine, Switzerland, Sweden, Spain, Slovenia, Italy, Germany, France, Canada, Australia, and Belgium. The collaborative international effort highlighted the global stance against child exploitation and cybercrime.
This operation is particularly notable in light of another significant law enforcement achievement from the previous year, wherein the Kidflix CSAM platform was successfully taken offline. This earlier initiative, known as Operation Stream, resulted in the identification of 1,393 suspects worldwide and also received considerable support from the Bavarian authorities and Europol. The Kidflix platform had been operational since 2021 and, unlike "Alice with Violence CP," it had offered genuine CSAM to a staggering 1.8 million registered users.
The crackdown on these chilling criminal enterprises symbolizes a unified global response against child exploitation and serves as a stern warning to those engaging in illicit activities. It not only sheds light on the intricacies of these operations but also reinforces the unwavering commitment of law enforcement agencies to protect vulnerable children and bring offenders to justice.