Crimenetwork: third relaunch seized as the c-network.to domain falls to a BKA banner

Visitors who type c-network.to today get an official German seizure banner instead of a forum. The domain belonged to Crimenetwork, one of the best-known German-language trading places for stolen data, drugs and forged documents. According to Tarnkappe.info and heise online, the Federal Criminal Police Office (BKA) took the domain on 18 August 2026, roughly two and a half months after this third version of the forum had gone online at the end of May. The BKA confirmed to heise that it carried out the measure, but has not yet published a detailed account. For the fraud forums of the German-speaking underground, it was the second blow to the same brand within a single year.

What the May takedown established

The August seizure had a well-documented prelude. In early May 2026, the Central Office for Combating Internet Crime (ZIT) at the Frankfurt public prosecutor's office and the BKA shut down the previous relaunch of Crimenetwork in an internationally coordinated operation. The suspected operator, a 35-year-old German citizen, was arrested at his home on Mallorca by a special unit of the Spanish National Police, acting on a European arrest warrant. According to the BKA's press release of 8 May 2026, the platform had more than 22,000 users and over 100 vendors trading in stolen data, drugs and forged documents. Investigators put turnover above 3.6 million euros: the operator collected commissions on sales, while vendors paid monthly fees for advertising and sales licenses. Roughly 194,000 euros in assets were provisionally secured, alongside extensive user and transaction data. Users paid in Bitcoin, Litecoin and Monero. Spanish and Moldovan authorities and Eurojust supported the action, and prosecutors in Karlsruhe ran a parallel investigation into commercial fraud.

Three takedowns in twenty months

The brand's history reads like a case study in shrinking lifecycles. The original Crimenetwork operated for years — Infosecurity Magazine dates it to 2012 — until police shut it down and arrested its administrator in December 2024. In March 2026, the Landgericht Gießen sentenced that administrator to seven years and ten months in prison and ordered the confiscation of proceeds exceeding ten million euros. The BKA states that within days of the December 2024 takedown, the 35-year-old built an entirely new technical infrastructure and gave it the same name. That relaunch survived until the May 2026 operation. The third version appeared at the end of May 2026, weeks after its predecessor fell, and its domain was seized on 18 August. Tarnkappe.info counted less than two and a half months from launch to takedown. Each iteration rebuilt servers and user bases, and each one ended sooner.

What a seizure banner does and does not prove

A seizure banner is good evidence that authorities control a domain. It is not, by itself, evidence of much beyond that. Whether investigators also obtained the forum's servers remains unconfirmed: heise reports that the BKA declined to comment on that question, while Tarnkappe.info describes claims that staff of the ZIT and BKA may have access to the servers, explicitly as unverified rumors. If the servers were captured unencrypted, that would eventually be a serious problem for former members; if not, the banner mainly burns one address among many that this community has shown it can replace. The distinction matters in the other direction too, because the banner format itself has been abused — scammers imitate official takedown notices to frighten site owners into paying, a pattern we covered in our piece on when seizure banners are part of the scam. On c-network.to, the BKA's own confirmation and the May enforcement record support the banner being genuine.

Why the relaunches keep collapsing

One of the forum's admins had already conceded the broader point. In comments to Tarnkappe.info, an administrator known as mother wrote that the team respected the risks of running the project and had done what it could to secure it, adding, in translation:

There is no absolute security, and no complete anonymity on the internet, even if you place the web servers in the Tor network.

The structural reasons for the repeated collapses are not mysterious.

• The operator pool is small, and successors inherit attention: the May suspect allegedly launched his version within days of the December 2024 arrest, which kept him squarely in the investigation's focus.
• Revenue centralizes risk. Commissions and vendor fees funnel through a small team, so arresting one or two people halts the whole platform.
• The brand itself is a liability. A known name draws returning users quickly, but it also guarantees that police watch every successor from day one.

For the remaining German-language forums, the effect is twofold. Tarnkappe.info notes that competitors such as Germania and CrimeState are likely to absorb Crimenetwork's displaced users, but the same sequence of arrests shows what running such a platform now costs. The May operation produced extensive user and transaction data that investigators still have to evaluate, and the BKA set up a separate information site for former users of the platform. Between the March sentence, the May arrest and the August seizure, the Crimenetwork file shows both a community that keeps rebuilding and an enforcement side that closes each rebuild sooner than the last.