More than 373,000 dark web websites were shut down during a global law enforcement operation backed by Europol targeting a network that advertised child sexual abuse material and other illicit services.
The action, known as Operation Alice, ran from 9 to 19 March and involved authorities from 23 countries, Europol reported on Friday.
German authorities led the operation with support from Europol.
Investigators began looking into a dark web platform called “Alice with Violence CP” in mid-2021 and later found that its operator was running a vast web of fraudulent sites.
The sites promoted child sexual abuse material — often shortened to CSAM — and “cybercrime-as-a-service”, meaning criminal services sold online such as stolen credit card data or access to hacked systems.
Authorities identified one alleged perpetrator behind the platform and 440 customers worldwide who used the operator’s services.
Additional investigations were launched into those customers and more than 100 cases are still ongoing.
What investigators say the network did
A single person operated more than 373,000 “onion domains” — website addresses designed to mask where a site is hosted and who is visiting it — on the dark web over nearly five years, according to Europol.
Between February 2020 and July 2025, more than 90,000 of those onion domains were used to access platforms where CSAM was advertised.
Customers were told they could buy “packages” by providing an email address and paying in Bitcoin, with advertised prices ranging from €17 to €215.
The sites were fraudulent and did not deliver the promised material, despite advertising and previewing it.
The platform operator is a 35-year-old man based in China. Investigators estimate he made more than €345,000 from about 10,000 customers worldwide.
A network of up to 287 servers was used at its peak, including 105 located in Germany. German authorities have issued an international arrest warrant.
Alongside the website shutdowns, the operation led to 105 servers being seized and the seizure of electronic devices including computers and mobile phones.
The UK’s National Crime Agency took part in the operation, along with agencies including the FBI-equivalent Homeland Security Investigations in the US and the Australian Federal Police.
