{"id":743,"date":"2026-05-22T08:54:19","date_gmt":"2026-05-22T08:54:19","guid":{"rendered":"https:\/\/quantusintel.group\/osint\/blog\/2026\/05\/22\/tracing-the-nexus-between-forced-scamming-and-child-sextortion\/"},"modified":"2026-05-22T08:54:19","modified_gmt":"2026-05-22T08:54:19","slug":"tracing-the-nexus-between-forced-scamming-and-child-sextortion","status":"publish","type":"post","link":"https:\/\/quantusintel.group\/osint\/blog\/2026\/05\/22\/tracing-the-nexus-between-forced-scamming-and-child-sextortion\/","title":{"rendered":"Tracing the Nexus Between Forced Scamming and Child Sextortion"},"content":{"rendered":"


\nThis blog was written by Chris Conrad<\/a> from International Justince Mission (IJM)<\/a>. IJM is part of the Maltego Grants Program, and Chris works as an ILED Program Specialist supporting global programs focused on protecting and keeping communities safe.\u00a0
\n<\/small><\/p>\n

International\u202fJustice Mission<\/a>\u00a0(IJM) combats violence by partnering with local authorities to rescue victims, support survivors, and strengthen justice systems.<\/strong>\u202fWe address crimes\u202fof trafficking and slavery, violence against women and children, and police abuse of power\u202fby implementing\u202four\u202fcommunity protection model<\/a>\u202faround the world.\u202f\u00a0<\/p>\n

One of the\u202fcrime types IJM seeks to address\u202fis an expanding form\u202fof\u202flabor\u202ftrafficking called \u201cForced Scamming<\/a>\u201d.<\/strong> Over the past several years, IJM teams in Southeast Asia have\u202fobserved\u202fthe\u202fproliferation\u202fof\u202fscam\u202fcompounds, in which\u202ftrafficking\u202fvictims are coerced into carrying out online fraud schemes. The\u202fscam\u202foperations are estimated to generate billions of dollars annually, and\u202fthe\u202forganized crime groups\u202fbehind these operations\u202fhave subjected\u202ftrafficking victims to\u202fgrave abuses such as\u202fsexual exploitation, torture, and murder\u202fas a means of control.<\/strong>\u202f\u00a0<\/p>\n

IJM\u202fassists\u202fforced scamming survivors who have escaped\u202ffrom these locations\u202for were released after paying a ransom,\u202fand advocates for their rights within the justice system. This\u202fincludes\u202fparticipation in\u202fformal victim identification processes\u202fand working closely with relevant embassies and agencies to\u202ffacilitate\u202fthe safe repatriation of survivors to their home countries. Through survivor interviews, IJM has also supported authorities with investigations into the\u202fcriminal networks behind forced scamming operations throughout the region.\u202f\u00a0<\/p>\n

Following the Digital Trail<\/h2>\n

In 2025, IJM received funding from\u202fSafe Online<\/a>\u202fand\u202fthe\u202fThomson Reuters Social Impact Institute<\/a>\u202fto conduct research into\u202fsuspected\u202fties\u202fbetween forced scamming and another emerging online threat,\u00a0the financial sexual extortion of children. Through IJM\u2019s work on forced scamming, analysts\u202fencountered\u202frepeated\u202fuse of\u202fshared\u202fscripts in\u202fscam\u202foperations, resembling\u202fchat\u202flogs from\u202fchild sextortion cases reported to the\u202fNational Center for Missing and Exploited Children (NCMEC)<\/a>.\u202fOur research\u202fsought\u202fto answer the question:\u00a0Can we\u202fidentify\u202fcases of child sextortion linked to forced scamming compounds in Southeast Asia?<\/strong>\u202f\u00a0<\/p>\n

NCMEC receives\u202fCyberTipline\u202fReports<\/a>\u00a0from electronic service providers whenever they\u202fencounter\u202fevidence of online sexual exploitation or abuse of children.\u202fThrough an analysis of more than 1.18 million\u202fCyberTipline\u202fReports that included suspect IP addresses and internet connection timestamp data, IJM\u202fidentified\u202fmore than\u202f18,000 CyberTipline Reports<\/a>\u202fthat shared IP addresses used by devices in 40 identified\u202fscam\u202fcompounds.\u202f\u00a0<\/p>\n

Our research team also compared\u202finternet connection\u202ftimestamp data\u202fas part of the\u00a0study\u202fto\u202fidentify\u202fapproximately\u202f500\u202fCyberTipline\u202fReports most likely\u202fto be\u202flinked\u202fto forced scamming\u202foperations.\u202fThe\u202fstudy\u202fhas highlighted the need for investigators and\u00a0researchers to continue\u202fexploring\u202fthis\u202fnexus between forced scamming and sextortion\u202fcases and\u202fwork together across crime types to address these growing online threats.\u202f\u00a0<\/p>\n

Continuing the Investigation Using Maltego<\/h2>\n

IJM\u00a0is part of the\u00a0Maltego\u202fGrants Program, receiving access to Maltego\u00a0products, including\u202fData Pass<\/a>. As a continuation of the investigation into forced scamming operations, we took\u202f434 IP addresses\u00a0linked to\u00a0CyberTipline\u202fReports and forced scamming compounds, then mapped them into a graph to visualize the connections\u00a0and gain a clearer overview of the linked infrastructure.<\/strong><\/p>\n


\n \"\"
\n<\/a><\/p>

Figure 1 IP address linked between child sextortion cases and forced scamming compounds<\/em><\/small><\/figcaption>

Some\u00a0IP addresses\u00a0also appeared\u00a0in data leaks, raising a new question:\u00a0\u201cCould we\u202fidentify\u202fthese IP addresses in any data leaks,\u202fand\u202fpivot\u00a0on\u00a0additional\u202finformation to\u202fidentify\u202fspecific entities tied to\u202fthese incidents?\u201d\u00a0<\/p>\n

Using\u202fDarkOwl\u2019s\u202fTransform within Maltego, we pulled in matching data leak records\u202ffor the IP addresses\u202fand examined\u202fthe\u202fassociated online\u00a0services.\u202fScam\u202fcompounds\u202fin\u202fSoutheast Asia are known to use online dating\u00a0platforms, gambling\u00a0services, and AI-generated\u00a0imagery\u00a0as part of their operations, which\u00a0was\u00a0reflected in\u202fseveral\u00a0of\u202fthe data leaks\u202fwe\u00a0observed.\u202fWe focused on data leaks from\u202fthese types of online services\u202fto get a picture of\u202fthe\u202fconnections.\u00a0<\/p>\n


\n \"\"
\n<\/a><\/p>

Figure 2 IP addresses from IJM’s research found in data leaks from online services plausibly used in forced scamming operations<\/em><\/small><\/figcaption>

This process has allowed IJM to triage IP addresses and continue\u202finvestigating\u202fthe associated\u202femail addresses, phone numbers, and online identities.<\/strong> The goal\u00a0was\u00a0to continue\u202fgenerating\u202fa multi-layered picture of how forced scamming compounds\u202foperate, and\u202fprovide credible leads to our partners in government and\u202ftechnology so they can address the\u202fnexus between human trafficking and online\u202fscams.\u202f\u00a0<\/p>\n

Conclusion<\/h2>\n

IJM\u2019s research highlights how online scamming networks are closely tied to human trafficking and child sexual extortion incidents. With support from the Maltego Grants Program, IJM can continue investigating these networks by turning single leads from internet infrastructure data into meaningful investigative insights.<\/strong>\u00a0<\/p>\n

For more information and to read IJM\u2019s full report, please visit:\u00a0https:\/\/www.ijm.org\/nexus-financial-sextortion-children-forced-scamming<\/a><\/p>","protected":false},"excerpt":{"rendered":"

This blog was written by Chris Conrad from International Justince Mission (IJM). IJM is part of the Maltego Grants Program, and Chris works as an ILED Program Specialist supporting global programs focused on protecting and keeping communities safe.\u00a0 International\u202fJustice Mission\u00a0(IJM) combats violence by partnering with local authorities to rescue victims, support survivors, and strengthen justice … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":744,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-743","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/posts\/743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/comments?post=743"}],"version-history":[{"count":0,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/posts\/743\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/media\/744"}],"wp:attachment":[{"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/media?parent=743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/categories?post=743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quantusintel.group\/osint\/wp-json\/wp\/v2\/tags?post=743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}