Operation Alice: a full-scale takedown on the dark web

On 20 March 2026, the Bavarian State Criminal Police Office (Bayerisches Landeskriminalamt – BLKA) announced the takedown and seizure of 373,000 onion domains on the dark web’s Tor network, in an operation coordinated by Europol with the participation of France’s OFMIN (Office for the Protection of Minors).

High-risk child abuse material, or a scam?

This mass takedown is the result of an investigation opened in 2021, after the discovery of an onion site called ‘Alice with Violence CP’ selling packs of child sexual abuse material on the dark web — a place of every risk and every scam.

The investigation gradually revealed that the site was not an isolated one, but part of a sprawling network run by an individual based in China. That network included not only ‘Alice with Violence CP’ but hundreds of replicas of the same site on mirror domains. If you need a reminder of what a mirror domain is, read part 1 of our article on mirrors.

More than that, the same network was made up of 31 further child abuse sites, themselves replicated across hundreds of mirrors. In all, 90,000 child abuse domains had been created on the dark web — by a single person.

– Full details of the operation here –

The BLKA stated that these sites claimed to sell child abuse material but were in fact a pure scam: customers received nothing after paying. That should not obscure two facts:

• 440 customers identified in this first phase of the investigation genuinely attempted to buy this illegal material.
• Some of these sites used images of child sexual abuse as bait. Child abuse material was therefore distributed on a large scale.

What Operation Alice means for Aleph

Aleph’s solutions exist to anticipate attacks and to manage traces and risks across every layer of the web, by collecting dark web data on a massive scale.

Far from stopping at those 32 child abuse sites and their 90,000 copies, the same individual created 90 further sites, replicated across 283,000 mirror domains, with an identical purpose: to defraud customers. Those sites offered other goods and services — counterfeit currency, hacked bank accounts, Amazon gift cards. Among the 90 non-child-abuse variants of his scams, he went as far as creating fake directories and fake search engines, meant to lend credibility and visibility to these bogus marketplaces.

Aleph had already noticed these fake engines and directories in July 2021, and we were asking ourselves about them at the time (back to the article on mirrors — part 2 this time).

Congratulations

Everyone at Aleph wants to salute this historic work, unmatched in scale, carried out by the BLKA and its partners. Fighting child abuse is in large part why our business, Aleph-Networks, was founded, and it remains central to our wider social commitment.

We therefore welcome the coming disappearance of these 373,000 domains with real satisfaction and relief. The domains seized by the BLKA account for 75% of the active domains we index.

And for our customers…

Far from being a loss to our infosphere (infosphere = the whole body of data we collect and keep up to date), identifying these domains, and their many mirrors, lets us set aside content that generated a great deal of noise of no use to the private sector. It also lets us sharpen the relevance of our monitoring and the depth of our collection on the domains that remain — those tied more specifically to the theft, resale and handling of stolen data.

For the private companies we work with, the point is to monitor their data leaks, assess their cyber exposure, and manage their traces and their risks on the deep and dark web, in order to anticipate the attacks being prepared against them.