Comment by lateforwork

I assume the country of origin is detected based on IP address. These fakers will now create Azure VMs hosted in the US, then login to those VMs and use X from the VM. A lot of scammers disguise their location using this method.