Skip to content
Operation Alice: Massive Dark Web Takedown of 373,000 Fraudulent Sites

Operation Alice: Massive Dark Web Takedown of 373,000 Fraudulent Sites

First seen 10 Sep 2026, 21:46 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 11, 2026 at 15:18 UTC
  • Operation Alice dismantled 373,000 fraudulent dark web sites run by one individual.
  • The operator scammed criminals by taking payments for illegal content that was never delivered.
  • 440 customers have been identified, with investigations ongoing against over 100 of them.

Between March 9 and March 19, 2026, law enforcement from 23 countries dismantled a vast network of 373,000 dark web sites operated by a single individual. This operation, known as Operation Alice, was led by German authorities and supported by Europol. The operator, a 35-year-old man from China, ran these fraudulent platforms for five years, scamming criminals by taking Bitcoin payments for illegal content that was never delivered. Investigators identified 440 customers who attempted to purchase illicit goods, leading to ongoing investigations against over 100 of them. The operation began with a single flagged site in 2021 and expanded significantly over time. The automated nature of the operation allowed the individual to manage a staggering number of sites without traditional infrastructure. The operator is currently wanted internationally, with an arrest warrant issued.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-06-01
Investigation into 'Alice with Violence CP' began
German authorities flagged a dark web platform, initiating a five-year investigation into its operations.
Darkwebdecoded
2026-03-09
Operation Alice launched
A coordinated effort by 23 countries began to dismantle the network of fraudulent dark web sites.
Darkwebdecoded
2026-03-19
Operation Alice concluded
The operation successfully shut down 373,000 dark web sites, all operated by a single individual.
Darkwebdecoded

More articles in this cluster (3)

Following this threat?

Track Ransom Cartel and Substack in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed