"Operation Alice": International crackdown on child abusers

International law enforcement agencies have shut down and placed warning banners on more than 373,000 darknet sites in "Operation Alice". The platforms sought customers with child pornography material. However, these were fake shops – after payment, none of the expected "goods" were delivered.

Since Tuesday, March 17, 2026, warning banners from law enforcement have adorned the hundreds of thousands of websites hosted on more than a hundred servers. There is an arrest warrant against the operator, and investigations are underway against around 600 individuals.

Child pornography material as bait

The sites and platforms used by the operator to lure child abusers had names like "Alice with Violence CP", "Raped Bitches", or "Exclusive Baby Sluts CP". They displayed images of severe sexual abuse of young children. The operator offered images of "Boys" for 23 US dollars or "Girls" for 45 US dollars on more than 90,000 websites across 32 different platforms. The price range was between 20 and 250 US dollars for sending download links to archives containing a few gigabytes to several terabytes of child pornography images and videos.

Interested parties had to pay with the cryptocurrency Bitcoin and provide an email address. Despite advertising with actual child pornography material, the operator delivered nothing after payments were made. On a total of 122 platform variants with 373,000 .onion domains, there were also supposed cybercrime-as-a-service offers such as credit card data or access to compromised systems. "The goal was always to induce potential customers to pay without providing anything in return," explains the Bavarian State Criminal Police Office (LKA).

Investigators used tools like a Dark Web Monitor – a search engine for the darknet – and GraphSense for tracking payment flows, which helped them track down the operator. The cryptocurrency flows led to a legitimate payment service provider. With the data stored there, the accesses of the accused to the platforms could be proven and assigned to the purchased data packages. Investigations are ongoing against the platform operator, a 35-year-old Chinese citizen residing in China, and against approximately 600 users. So far, 440 have been identified who made payments on these platforms between February 2020 and July 2025, explains the Bavarian State Criminal Police Office.

Throughout the entire investigation period, law enforcement intervened directly when acute dangers to children were identified. If it became known that children were living with suspects, the cases were handed over to the responsible judicial and police authorities. As an example, the Bavarian LKA cites a 31-year-old father who wanted to buy a 70-gigabyte package of child pornography material from the platform "CP Video HD" for 20 US dollars. During the search, data deletion was prevented by triggering a dead man's switch, and the man was subsequently legally convicted.

"Operation Alice" began as a worldwide operation on March 9, 2026, and ran until March 19. Twenty-three countries participated, from Australia to Spain to Canada. Europol coordinated the operation. In Germany, 14 searches were conducted involving 14 suspects from nine federal states. In total, proceedings against 89 defendants from Germany were conducted within the overall investigation. Investigations in the overall complex are still ongoing with the support of Interpol.

(dmk)