LmCast :: Stay tuned in

Police take down 373,000 fake CSAM sites in Operation Alice

Recorded: March 20, 2026, 9 p.m.

Original Summarized

Police take down 373,000 fake CSAM sites in Operation Alice

News

Featured
Latest

Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

Microsoft Azure Monitor alerts abused for callback phishing attacks

Musician admits to $10M streaming royalty fraud using AI bots

FBI links Signal phishing attacks to Russian intelligence services

Varonis Atlas: Securing AI and the Data That Powers It

Microsoft Exchange Online service change causes email access issues

Block ads and trackers on 9 devices for only $16 in this deal

FBI warns of Handala hackers using Telegram in malware attacks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityPolice take down 373,000 fake CSAM sites in Operation Alice

Police take down 373,000 fake CSAM sites in Operation Alice

By Bill Toulas

March 20, 2026
01:19 PM
0

An international law enforcement action called Operation Alice has shut down over 373,000 dark web sites that offered fake CSAM packages.
The investigation, led by Germany and supported by Europol, began in mid-2021 and focused on a platform called “Alice with Violence CP,” operated by a 35-year-old suspect based in China.
These sites advertised child sexual abuse material (CSAM) and cybercrime-as-a-service offerings, including stolen credit card data and access to compromised systems.

Seizure banner on one of the scam sitesSource: Europol
According to Europol, the sites used showed previews of claimed CSAM “packages” to trick users into entering their email addresses and paying between EUR 17 and EUR 250 in Bitcoin, receiving nothing in return.
“Each package had an estimated cost of between EUR 17 and EUR 215, and promised data volumes ranging from a few gigabytes to several terabytes of CSAM,” explains Europol.
“However, these were purely fraudulent sites where CSAM was advertised and previewed but never delivered.”
The fraudulent CSAM platform fooled around 10,000 users into paying roughly $400,000 to the operator of the sites. Of those, the authorities have identified 440 users in 23 countries, and are currently investigating 100 of them.
Although these people never received the illegal material, they still tried to purchase CSAM, financially supporting child abuse and demonstrating criminal intent. Even attempting to buy such material is prosecuted in many jurisdictions.
At its peak, the scam network’s infrastructure comprised 287 servers, with a significant portion (105) located in Germany, all of which have now been seized. German authorities have also issued an international arrest warrant for the Chinese operator.
Europol highlights its broader child protection work, including the Help4U support platform launched in November 2025, and its “Stop Child Abuse – Trace an Object” initiative, which invites people to identify the origin of objects seen in CSAM material that may lead to the identification of perpetrators, and the saving of children from abuse.

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
The Refund Fraud Economy: Exploiting Major Retailers and Payment Platforms Interpol operation Synergia takes down 1,300 servers used for cybercrimeInterpol disrupts cybercrime activity on 22,000 IP addresses, arrests 41Going the Extra Mile: Travel Rewards Turn into Underground Currency.Europol-coordinated action disrupts Tycoon2FA phishing platform

CSAM
Dark Web
Europol
Germany
Police
Seizure
Takedown

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Microsoft: March Windows updates break Teams, OneDrive sign-ins

CISA orders feds to patch max-severity Cisco flaw by Sunday

Microsoft Azure Monitor alerts abused for callback phishing attacks

Sponsor Posts

Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast.

Are refund fraud methods targeting your brand? You can monitor the underground for these threats.

AI is a data-breach time bomb: Read the new report

Secure your AI agents without sacrificing speed.

Overdue a password health-check? Audit your Active Directory for free

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Operation Alice, spearheaded by German law enforcement with substantial support from Europol, successfully dismantled a sophisticated network of approximately 373,000 dark web sites dedicated to the fraudulent distribution of Child Sexual Abuse Material (CSAM). Initiated in mid-2021, this international operation targeted the “Alice with Violence CP” platform operated by a 35-year-old individual based in China. The core function of this platform was the deceptive advertising and sale of CSAM previews, utilizing fabricated data volumes ranging from several gigabytes to terabytes, enticing users into providing their email addresses and paying between EUR 17 and EUR 215 in Bitcoin. Despite the lack of actual delivery, the operation successfully defrauded approximately 10,000 users of roughly $400,000, revealing demonstrable criminal intent to acquire illegal material.

The network’s infrastructure, initially comprising 287 servers, had a significant concentration of servers—105—located within Germany. Following a complete seizure of these servers, German authorities issued an international arrest warrant for the Chinese operator. Investigations led by Europol resulted in the identification of 440 users across 23 countries, with 100 of these individuals currently under investigation. The key significance of this operation stems not solely from the seizure of the fraudulent platform but also from the identification of individuals actively attempting to purchase CSAM, highlighting the persistent demand within criminal networks and demonstrating the effectiveness of law enforcement actions in disrupting these illicit activities.

Europol’s broader efforts in child protection are underscored by initiatives such as the Help4U support platform launched in November 2025 and the “Stop Child Abuse – Trace an Object” program, which leverages investigative techniques to identify the sources of CSAM material and subsequently, the perpetrators. The operation’s impact extends beyond the immediate takedown of the fraudulent platform; it serves as a crucial deterrent and a testament to the collaborative efforts undertaken by international law enforcement agencies to combat increasingly complex cybercrime. This operation highlights the ongoing struggle between law enforcement and criminal networks exploiting vulnerabilities within the dark web ecosystem.