Where the scam compounds are: the 2026 map.

How the system works

1. Recruitment: fake jobs abroad (customer support, IT, data entry, translation) on Telegram, Facebook and LinkedIn. Fake jobs abroad guide.
2. Transit: a flight to a regional hub such as Bangkok, then road travel to a border town and a paid crossing. In the Myawaddy corridor this runs through Mae Sot.
3. The compound: passports taken, quotas, fines and debt; workers run scripts against people overseas. Read their playbook.
4. Infrastructure: electricity, mobile and satellite internet keep sites online. SpaceX said in October 2025 it disabled more than 2,500 Starlink terminals near Myanmar compounds.
5. Money: stolen funds move through crypto (often USDT), mule accounts and cash-out networks. Several companies tied to these networks have been sanctioned by the US Treasury.
6. Crackdown and displacement: raids move operations rather than end them: smaller, mobile sites, new countries, and condos instead of compounds.

What the statuses mean

• Active: Credible reporting in 2026 that it operates.
• Disrupted: Raided or cracked down on, with reports of continued or relocated activity.
• Emerging: New location reported in 2025–2026.
• Reported closed: Authorities or credible reports say it was shut, with no later reports of activity.
• Uncertain: Limited or conflicting reporting.

Methodology and corrections

Every hub is built from published sources, listed on its page, and described in “reported” terms. Companies or people are named only where a government has formally sanctioned or charged them. Locations are approximate on purpose. If you have evidence that an entry is wrong or out of date, write to theredbullleaks@proton.me. If you are inside one of these places, see the secure drop first.