Methodology for AP/'FRONTLINE' investigation into how US tech is abused for global scams

The AP/"FRONTLINE" investigation was based on tens of thousands of leaked scam center files, videos and photos; an analysis with C4ADS of misuse of artificial intelligence at scam centers; an examination of more than 200,000 connections made by devices at four scam compounds in Myanmar linked to entities sanctioned by the U.S. government; and interviews with 58 scam victims and three dozen current and former scammers from 19 countries.

The Associated Press analyzed a sample of 202,013 connections made by devices at four scam compounds in Myanmar that have been linked to entities sanctioned by the U.S. government.

International Justice Mission, an anti-trafficking non-profit, obtained the commercially available ad tech data, which covers several time intervals between February 2025 and January 2026, and shared it with the AP.

Each event in the dataset logs a device’s geographic coordinates and its IP address. AP used a database maintained by Scamalytics, a fraud prevention company, to identify which ISPs had been allocated the IP addresses in the dataset. In case of conflicting or ambiguous results, AP prioritized IP allocations identified by Scamalytics.

This combination allowed us to identify not just where internet traffic was physically coming from, but which companies profit from hosting it.

The data was enriched with risk indicators assigned by Scamalytics, including open source blacklists maintained by Firehol, IP2ProxyLite, IPSum, Spamhaus and X4Bnet Spambot, and Scamalytics’ own risk score, which it assigns based on fraud reports and their own analysis. These scores are indicators of potential risk, rather than evidence of proven fraud.

There are several important caveats. This dataset captures only geolocation-enabled devices. The actual internet infrastructure serving these compounds is significantly larger than what is recorded here.

Spur Intelligence Corporation, a cybersecurity company, reviewed the data and found instances of ad fraud. AP removed known instances of devices used to run ad fraud identified by Spur. There may well be more that we were unable to detect.

Telecommunications companies and internet service providers can meet a range of digital needs for scammers, including: Connecting to the internet; running and hosting fraudulent platforms like fake crypto or spoofed shopping sites; using VPNs or proxy networks to mask their true locations; and simply transiting traffic across the internet. While patterns in the data may suggest one use case over another, no definitive conclusions can be drawn from the commercially available data alone.

Devices in the dataset were geolocated to the following compounds: Tai Chang, Deko Park, KK Park and a new compound near Hpakalu, Myanmar.

KK Park, like most scam compounds along the Thai border, operates under the protection of the Karen Border Guard Force — also known as the Karen National Army (KNA) — an armed militia made up of ethnic Karen people who live in eastern Myanmar that is affiliated with the Myanmar military, according to U.S. and European government sanctions notices. The U.S. Treasury designated the Karen National Army as a transnational criminal organization in May 2025, citing its role in facilitating cyberscams targeting US citizens and human trafficking. Treasury’s Office of Foreign Assets Control (OFAC) said the KNA provided security for KK Park and has profited from scam operations by leasing land to criminal syndicates. In October 2025, Myanmar’s military government led a high-profile demolition campaign against KK Park. Scammers scattered, including to an emerging site in Hpakalu. The International Justice Mission found that some devices active in KK Park shortly before the raids were active in Hpakalu in Jan. 2026.

Deko Park and Tai Chang are located in territory controlled by the Democratic Karen Benevolent Army (DKBA). The U.S. Treasury Department sanctioned the DKBA in November 2025, citing its role in supporting cyberscam centers, including the Tai Chang compound, where rescued trafficking victims have reported torture and beatings by DKBA soldiers.

The AP also verified satellite imagery of 25 new scam compounds in Myanmar identified by International Justice Mission, which have appeared or grown significantly since the high-profile crackdown against KK Park and other compounds in October 2025. AP analyzed a sample of device activity at these sites between March 1, 2026, and June 1, 2026, which was provided by the International Justice Mission. At least 13 of them used Starlink IP addresses. Again, that data covers only a sample and may not capture all Starlink activity at these locations.

The AP shared detailed data about the location and timing of device connections with each company named in the story.

—-

This story is part of an ongoing collaboration between The Associated Press and “FRONTLINE” (PBS) that includes an upcoming documentary.

—-

The Associated Press receives financial support from multiple private foundations. AP is solely responsible for all content. Find AP’s standards for working with philanthropies, a list of supporters and funded coverage areas at AP.org.

—-

Contact AP’s global investigative team at Investigative@ap.org or https://www.ap.org/tips/