In March 2026, an international operation coordinated by German authorities with the support of Europol culminated in one of the largest actions against cybercrime and child abuse networks on the dark web. Known as Operation Alice, this initiative brought together law enforcement from 23 countries with the aim of dismantling a massive infrastructure of fraudulent sites linked to illegal content and criminal services.

The investigation, initiated in 2021, revealed that a single operator controlled more than 373,000 “.onion” domains, that is, sites accessible through the Tor network designed to conceal the identity and location of both servers and users. This figure places the case as one of the largest ever detected in this area.
The portals simulated offering child sexual abuse material (CSAM) and other cybercrime services, such as the sale of credit card data or illegal access to computer systems. However, it was primarily a fraudulent operation: customers paid—usually in Bitcoin—but did not receive any content.
The announced “packages” ranged from 17 to 215 euros and promised large volumes of data. This model combined two criminal dimensions: the exploitation of extremely serious content and a massive global scam.
Between 9 and 19 March 2026, the authorities achieved significant results:
- Identification of the main operator of the network
- Identification of 440 clients worldwide
- Closure of more than 373,000 sites on the dark web
- Confiscation of 105 servers
- Seizure of electronic devices and digital data
According to the authorities, the responsible party is a 35-year-old male residing in China, who would have generated more than 345,000 euros in profits from about 10,000 clients. During the period of activity, he managed up to 287 servers simultaneously, many of which were located in Germany.
One of the most relevant aspects of the operation is that not only has the supply been targeted, but also the demand. The 440 individuals identified as clients are considered suspicious, despite not having received the advertised material.
From a legal and security standpoint, the mere attempt to acquire such content constitutes a serious crime in many jurisdictions. Additionally, security forces consider these individuals as high-risk targets, as they may be involved in other criminal activities or pose a potential threat.
Throughout the investigation, the authorities acted immediately in those cases where minors in risk situations could be identified. This dimension is key: beyond the repression of crime, whose primary objective is the protection of victims.
For example, in 2023, action was taken in the case of an individual in Germany who had attempted to acquire illegal material, which led to his subsequent conviction. These types of actions demonstrate how the obtained intelligence can have a direct impact on abuse prevention.
Europol played a key role in coordinating the operation, facilitating the exchange of information between countries and providing advanced analytical capabilities. It also contributed decisively to the tracking of cryptocurrency transactions, a key element for identifying both the operator and the users. This case demonstrates that, despite the use of anonymization technologies such as Tor or payments in Bitcoin, law enforcement can reconstruct criminal activity through digital forensic analysis and international cooperation.
Operation Alice sends a strong message: anonymity on the internet is not absolute, and criminal infrastructures, no matter how sophisticated, can be dismantled. The combination of digital investigation techniques, financial tracking, and international collaboration has consolidated as an effective tool against global cybercrime.
For the security sector, this case highlights several key lessons: the importance of shared intelligence, the need to address both supply and demand, and the value of technology in combating complex threats.
Ultimately, this is an operation that has not only dismantled a massive network but also strengthens the global capacity to detect, pursue, and prevent serious forms of online criminality.
_____
Aquest apunt en català / Esta entrada en español / Post en français

