Operation Alice Dismantles Massive Fake CSAM Network, Exposing Thousands of Users
An international law enforcement operation, dubbed 'Operation Alice,' has successfully shut down a sprawling network of over 373,000 dark web sites peddling fraudulent Child Sexual Abuse Material (CSAM) packages. The operation, led by Germany and supported by **Europol**, has exposed the dark underbelly of online exploitation and the individuals willing to engage in such activities.

### Operation Alice: Unmasking the Scam
The investigation, initiated in mid-2021, targeted a platform known as "Alice with Violence CP," allegedly operated by a 35-year-old suspect based in China. These deceptive sites lured users with previews of purported CSAM "packages," while also advertising cybercrime-as-a-service offerings, including stolen credit card data and unauthorized access to compromised systems.
### The Deceptive Scheme
According to **Europol**, the sites enticed users to input their email addresses and pay between EUR 17 and EUR 250 in Bitcoin for the promised CSAM. However, victims received nothing in return, making the entire operation a sophisticated scam.
"Each package had an estimated cost of between EUR 17 and EUR 215, and promised data volumes ranging from a few gigabytes to several terabytes of CSAM," explains **Europol**. "However, these were purely fraudulent sites where CSAM was advertised and previewed but never delivered."
.jpg)
*Seizure banner on one of the scam sites
Source: Europol*
### Thousands Duped, Hundreds Under Investigation
The fraudulent CSAM platform deceived approximately 10,000 users, generating an estimated $400,000 in revenue for the operator. Authorities have identified 440 users across 23 countries and are actively investigating 100 of them.
Even though these individuals did not receive the illegal material, their attempt to purchase CSAM constitutes criminal intent and financially supports child abuse, which is prosecuted in many jurisdictions.
### Infrastructure Seized, Arrest Warrant Issued
At its peak, the scam network relied on an infrastructure of 287 servers, with a significant portion (105) located in Germany. All servers have been seized, and German authorities have issued an international arrest warrant for the Chinese operator.
### Europol's Ongoing Efforts
**Europol** emphasizes its commitment to child protection through initiatives like the Help4U support platform (launched in November 2025) and the "Stop Child Abuse β Trace an Object" initiative. This initiative encourages individuals to identify objects within CSAM material that could lead to the identification of perpetrators and the rescue of child victims.
## [Red Report 2026: Why Ransomware Encryption Dropped 38%](https://hubs.li/Q043YRMg0)
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.
Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.