Or they may be in this country, but uses proxies, virtual machines, hostings from uncooperative country.

Less likely and when they are usually they're immigrants and if they're investigated they just go back home.