Skip to main content
Back to the takedown index

Serengeti 2.0

August 2025, Fraud and stolen data
Led by International Criminal Police Organization, African Union Mechanism for Police Cooperation

Extended pass entry, last reviewed August 21, 2026

What was taken down?

More than 11,000 malicious infrastructures disrupted.

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

A joint INTERPOL/AFRIPOL operation across 18 African countries plus the UK disrupted more than 11,000 malicious infrastructures connected to online fraud.

Date
August 2025
Target
Fraud infrastructure across 18 African countries, multi threat infrastructure
Activity
Fraud and stolen data
Operational lead
INTERPOL and AFRIPOL
Jurisdiction
Not established
Outcome
More than 11,000 malicious infrastructures disrupted.
Status
Completed
Legal mechanism
Coordinated national judicial/search-and-seizure authority across participating countries.
Group accounted for
Not applicable

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Operation Serengeti 2.0 disrupts over 11,000 malicious cyber infrastructures in Africa

    INTERPOL / AFRIPOL, August 22, 2025, Source grade P2

    Establishes the 18-country-plus-UK scope and 11,000+ malicious infrastructures figure.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.