Europol said the disrupted CSAM “as-a-service” network took payments from customers but failed to deliver the promised material. The operation identified customers and said investigations into them are ongoing.

Europol described a dark web operation that combined illicit marketing with financial fraud. The crackdown targeted a network promoting CSAM “as-a-service,” using a very large dark web footprint to attract customers and drive payments. Authorities reported that the action shut down 373,000+ dark web sites, aiming to halt the scam’s ability to advertise and recruit new buyers. The key detail in Europol’s account is that the service model was not legitimate delivery. Law enforcement said customers who paid were not provided the content they were promised. Investigators framed this as a fraudulent scheme, where payment requests and assurances were used to monetize victims’ willingness to pay while the promised access never materialized. Europol also reported seizure of infrastructure as part of the operation, including 105 servers tied to the network. By removing both the online presence (websites) and core technical assets (servers), authorities intended to disrupt not only immediate advertising but also the underlying systems supporting operations. Critically, Europol noted that the investigation has already identified customers associated with the scam. Follow-on efforts are underway to pursue those individuals, indicating that the operation is more than a one-time takedown. Investigators are expected to continue using evidence gathered during the disruption to identify payment relationships, user activity, and any connected facilitators. While the dark web sites were taken offline, Europol’s message underscored that law enforcement response includes tracing actors who paid and interacting with broader investigative networks to build accountability.