Police Shut Down 373,000 Dark Web Sites in Single-Operator CSAM Network
scsecMarch 27, 20261 Mins read 
A massive international law enforcement operation has shut down more than 373,000 dark web sites linked to a single cybercriminal, marking one of the largest coordinated takedowns in recent history. The network, which offered cybercrime-as-a-service (CaaS) and hosted illegal content, including child sexual abuse material (CSAM), was run by a 35-year-old man reportedly based in China.
Operation Alice
The investigation, which began in 2021, was led by German authorities with support from Europol and involved agencies from 23 countries. The network was centered on a dark web platform known as “Alice with Violence CP.” Law enforcement uncovered a staggering scale of activity, with one individual operating hundreds of thousands of onion domains. These sites flooded the dark web with fake marketplaces that advertised illegal content and cybercrime services but primarily served to collect cryptocurrency from users without fulfilling any orders.
From March 9 to March 19, 2026, authorities seized over 100 servers and electronic devices, disrupting the infrastructure supporting the network. In addition, domain seizure notices are now visible across the dark web sites formerly operated by the suspect.
Users and Financial Impact
Investigators identified approximately 440 individuals who had used the platform, with more than 100 cases still under active investigation. Even though the services were fraudulent, attempting to purchase illegal material remains a criminal offense in most jurisdictions.
The suspect reportedly earned over €345,000 from roughly 10,000 customers, offering packages priced between €17 and €215, all paid in cryptocurrency. By using hundreds of thousands of short-lived websites, the operator made tracking and enforcement significantly more challenging, creating the illusion of a much larger operation.
Ongoing Investigation
Europol confirmed that an international arrest warrant has been issued for the main suspect. Authorities continue to pursue any remaining infrastructure and track individuals associated with the network, highlighting the global scope of dark web cybercrime enforcement.
This operation demonstrates the sophistication and scale of modern cybercriminal networks and the necessity of international collaboration to combat online exploitation and criminal activity.
1 Comment
Leave a Reply
Related Articles
FBI Warns of Iran-Linked Handala Hackers Spying on Windows Users via Fake Apps
The FBI has issued a warning about Iran-linked Handala Hack Group, which...
Google Launches Advanced Flow to Make Android APK Sideloading Safer
Google has introduced a new Android feature called Advanced Flow, designed to...
Navia Breach Exposes Sensitive Data of 2.7 Million in Weeks-Long Undetected Cyberattack
Navia Benefit Solutions, Inc., a U.S.-based benefits administrator, has disclosed a data...
Iran’s Pre-Planned Cyber Offensive: Six Months of Silent Preparation Before the 2026 Strikes
Iran-linked cyber groups significantly ramped up their activity following the late February...
This operation underscores the scale and complexity of modern dark web criminal networks. The fact that a single individual managed over 373,000 sites highlights both the challenges of monitoring illicit online activity and the importance of international cooperation in law enforcement. Efforts like Operation Alice are critical not only for disrupting cybercrime but also for protecting vulnerable populations from exploitation.