This blog was written by Chris Conrad from International Justince Mission (IJM). IJM is part of the Maltego Grants Program, and Chris works as an ILED Program Specialist supporting global programs focused on protecting and keeping communities safe.
International Justice Mission (IJM) combats violence by partnering with local authorities to rescue victims, support survivors, and strengthen justice systems. We address crimes of trafficking and slavery, violence against women and children, and police abuse of power by implementing our community protection model around the world.
One of the crime types IJM seeks to address is an expanding form of labor trafficking called “Forced Scamming”. Over the past several years, IJM teams in Southeast Asia have observed the proliferation of scam compounds, in which trafficking victims are coerced into carrying out online fraud schemes. The scam operations are estimated to generate billions of dollars annually, and the organized crime groups behind these operations have subjected trafficking victims to grave abuses such as sexual exploitation, torture, and murder as a means of control.
IJM assists forced scamming survivors who have escaped from these locations or were released after paying a ransom, and advocates for their rights within the justice system. This includes participation in formal victim identification processes and working closely with relevant embassies and agencies to facilitate the safe repatriation of survivors to their home countries. Through survivor interviews, IJM has also supported authorities with investigations into the criminal networks behind forced scamming operations throughout the region.
Following the Digital Trail 🔗︎
In 2025, IJM received funding from Safe Online and the Thomson Reuters Social Impact Institute to conduct research into suspected ties between forced scamming and another emerging online threat, the financial sexual extortion of children. Through IJM’s work on forced scamming, analysts encountered repeated use of shared scripts in scam operations, resembling chat logs from child sextortion cases reported to the National Center for Missing and Exploited Children (NCMEC). Our research sought to answer the question: Can we identify cases of child sextortion linked to forced scamming compounds in Southeast Asia?
NCMEC receives CyberTipline Reports from electronic service providers whenever they encounter evidence of online sexual exploitation or abuse of children. Through an analysis of more than 1.18 million CyberTipline Reports that included suspect IP addresses and internet connection timestamp data, IJM identified more than 18,000 CyberTipline Reports that shared IP addresses used by devices in 40 identified scam compounds.
Our research team also compared internet connection timestamp data as part of the study to identify approximately 500 CyberTipline Reports most likely to be linked to forced scamming operations. The study has highlighted the need for investigators and researchers to continue exploring this nexus between forced scamming and sextortion cases and work together across crime types to address these growing online threats.
Continuing the Investigation Using Maltego 🔗︎
IJM is part of the Maltego Grants Program, receiving access to Maltego products, including Data Pass. As a continuation of the investigation into forced scamming operations, we took 434 IP addresses linked to CyberTipline Reports and forced scamming compounds, then mapped them into a graph to visualize the connections and gain a clearer overview of the linked infrastructure.
Some IP addresses also appeared in data leaks, raising a new question: “Could we identify these IP addresses in any data leaks, and pivot on additional information to identify specific entities tied to these incidents?”
Using DarkOwl’s Transform within Maltego, we pulled in matching data leak records for the IP addresses and examined the associated online services. Scam compounds in Southeast Asia are known to use online dating platforms, gambling services, and AI-generated imagery as part of their operations, which was reflected in several of the data leaks we observed. We focused on data leaks from these types of online services to get a picture of the connections.
This process has allowed IJM to triage IP addresses and continue investigating the associated email addresses, phone numbers, and online identities. The goal was to continue generating a multi-layered picture of how forced scamming compounds operate, and provide credible leads to our partners in government and technology so they can address the nexus between human trafficking and online scams.
Conclusion 🔗︎
IJM’s research highlights how online scamming networks are closely tied to human trafficking and child sexual extortion incidents. With support from the Maltego Grants Program, IJM can continue investigating these networks by turning single leads from internet infrastructure data into meaningful investigative insights.
For more information and to read IJM’s full report, please visit: https://www.ijm.org/nexus-financial-sextortion-children-forced-scamming
