No Safe Haven: Law enforcement agencies around the world have carried out one of the largest crackdowns targeting a dark web – hosted cybercrime operation to date. A single individual managed hundreds of different onion sites and is now wanted under an international arrest warrant. Several hundred of his "customers" could also face prosecution in the coming months.
Europol recently unveiled "Operation Alice," a major effort to dismantle a large network of fraudulent websites hidden within the dark web. The investigation began in 2021 and initially focused on a platform named Alice with Violence CP. In the end, the operation took down one of the largest dark web platforms engaged in fraudulent and criminal activities.
Operation Alice was first launched by German authorities, who discovered that a single individual was managing more than 373,000 onion websites. Onion URLs are part of the Tor dark web, accessible through the Tor browser and other compatible software clients. The cybercriminal, a 35-year-old man based in China, allegedly lured customers into purchasing various "packages" of child sexual abuse material over a period of at least five years.
Investigators later discovered that he was also attempting to sell cybercrime-as-a-service (CaaS) products, including stolen credit card data and access to unsecured or breached systems. The criminal advertised his services across more than 90,000 onion domains and ultimately generated roughly €345,000 in profit from approximately 10,000 customers worldwide.
However, not a single customer received what they were paying for. Neither the CSAM packages – priced between €17 and €215 – nor the CaaS services were real. Europol reported that the fraudster operated 287 servers at peak business hours, 105 of them located in Germany alone. As a result, German authorities have issued an international arrest warrant for the Chinese suspect.
Earlier this month, Europol coordinated an international coalition of 23 countries to dismantle the network entirely. Investigators identified 440 customers who attempted to purchase CSAM or CaaS "products," with ongoing investigations now targeting more than 100 additional individuals.
The Operation Alice coalition seized 105 servers, along with an undisclosed number of computers, mobile devices, and other electronic data carriers. According to Europol Executive Director Catherine De Bolle, "Operation Alice sends a clear message: there is nowhere to hide for criminals when the international law enforcement community works hand in glove."
As has been noted previously, the dark web is no "magical" place where criminals can operate with impunity. Tor is built on standard web technologies with strong encryption, making it a valuable tool for researchers and privacy-conscious users accessing the internet from unsecured locations – but not a shield for cybercriminals.