DomainTools Investigations

Whenever a government service has constrained supply (slot scarcity, queue, complexity, deadline pressure) against motivated demand, an arbitrage opportunity exists. Citizens are willing to pay extra to jump the queue, get a faster slot, or take a shortcut. Where official supply doesn't expand to meet that willingness to pay, someone fills the gap. Sometimes it's a legitimate expediter, but more often, it's a scam.

The following shows a years-long campaign targeting Mexican citizens with a scam themed as a fast track service for government documents they branded as “Mexican Cita Express” or “Cita Express SRE México”. This scam alleges there is a fast track service to process government documents. In reality there is no official Mexican Cita Express or the like. The scam theme has continued for years using the same branding and themes due to the persistent government inefficiencies maintaining the scarcity for the scam to thrive. Because citizens can’t get appointments through legitimate pathways, citizens will often seek out other ways to access these services. Instead, they end up paying scammers in addition to giving away their personal information in the process.

‍

Wire Fraud and Identity Theft

To appear legitimate, the initial fraudulent fee ranges from $1,730 to $4,120 MXN, mirroring the real Secretaría de Relaciones Exteriores (Mexican Ministry of Foreign Affairs) passport pricing. After payment, the site fabricates additional bureaucratic obstacles including the need for 'Biometric Validation', 'Identity Depuration' and 'Final Release'. These obstacles pressure victims into making up to five additional transfers totaling $11,360 MXN. All victim data, including their Mexican national identification code, name, email address, phone number, and bank transfer receipt, is sent in real time to an operator-controlled Telegram bot. It is worth noting that older versions of this scam used PostHog site tracking and rrweb-recorder (Record and Replay the Web) to record every user interaction on the site. The newer Telegram bot approach likely allows the scammer to operate more asynchronously and autonomously by integrating AI workers into their scam workflows.

If all extortion stages are completed, the full per-victim financial exposure is $13,090–$15,480 MXN (approximately $650–$770 USD). Beyond the direct financial loss, the collection of Mexico's primary national identity number, Clave Única de Registro de Población (CURP), creates a downstream identity-theft risk. CURP is used as a Know Your Customer (KYC) control by Mexican financial institutions, meaning harvested CURP data can enable account fraud well after the immediate scam concludes.

The site code was seen to have hardcoded bank info which are likely scammer-controlled Mexican bank accounts the victim sees when they hit the "pay your passport fee" step. However, we suspect these are compromised or mule accounts. The fee for a real SRE passport appointment should go to the Mexican Treasury bank account, but this endpoint substitutes it with a hardcoded mule account. Several of these mule accounts were seen hardcoded into the various scam website’s code and are likely used to receive the stolen money from victims then forward onto laundering services.

From the site code standpoint, the fraud works in the following order:

Front end: pixel-perfect clone of the real SRE "Cita Express" portal (logo, palette, layout). The clone source is mexformclone.emergent.host. Emergent is an AI no-code app-builder platform used by the attacker to build a passable-enough, low-cost SRE replica there
Inline JS interceptor, planted at the top of <head> BEFORE React loads:
1. Replaces window.fetch
2. When the React app calls mexformclone.emergent[.]host/api/bank-details (the real source bank details), this interceptor blocks the external call and re-routes to local /api/bank-details, which then returns the fraudulent CLABE above.
3. Comments are in Russian such as “КРИТИЧЕСКОЕ ИСПРАВЛЕНИЕ: Блокируем внешний API ПЕРВЫМ ДЕЛОМ! Это предотвращает загрузку чужих реквизитов из внешнего источника”. Translation: "CRITICAL FIX: Block external API FIRST! This prevents loading OTHER people's [bank] details from external source".
4. Telegram-bot exfil: Their form data is posted to /api/telegram.php. It captures PII data including names, CURP (Mexican national ID), appointment office, dates, payment amounts.
Session recording of every victim via rrweb library (loaded from a customer-operated CloudFront distribution) and full keystroke/mouse playback for live monitoring and quality control.
Social-engineering urgency layer:
1. payment-text-replacer.js swaps in an "Aviso Importante" modal saying the victim has 30 minutes to pay or face a 12-month suspension.
2. confirmation-form-enhancer.js injects extra name fields and locks the "Confirmar pago" button until they're filled, maximizing data collection.
3. payment-handler.js redirects to /upload-receipt.html after click and exfiltrates again via keepalive POSTs (so the egress survives navigation).
  ‍

Hints of Russian Speaking Scammer & AI Generated Scam Content

Interestingly, the scam site code sets a +03:00 timezone in an “updated_at” variable, which is Moscow time. There is extensive use of Russian language comments throughout the site along with the use of various emojis. Both the extensive comments and emojis are common identifiers for AI generated content.

Identifiers & Registration Pattern

Website Title: Cita Express - SRE México
Email domain:
- ddos-guard[.]net
- ordertld[.]com
Registrar: CNOBIN INFORMATION TECHNOLOGY LIMITED
IP ISP: Iqweb Fz-llc
Server Type: ddos-guard

Often, multiple domains are grouped on the same IP addresses (domains list in Appendix)

IP Address	IP Address
186.2.175.75	186.2.175.63
186.2.175.77	185.149.120.203
186.2.175.21	186.2.175.17

These scams involving the Mexican government’s official passport application page have been going on for years, and a recent report by ESET in January 2026 mentions similar scam sites followed by an advisory by Mexico’s Ministry of Foreign Affairs. Despite this, the same scam continues, likely because the same government inefficiencies continue to impact citizens in need of those government services.

As it became apparent in this investigation, this activity has been reported on repeatedly with no meaningful change in behaviors by the scammers or changes by the government to address their role in the scams. Instead, we turn our attention to exploring the nature and conditions of these scams and hunting for other government-imposed scarcity scams like this one.

A PostHog token (phc_yJW1VjHGGwmCbbrtczfqqNxgBDbhlhOWcdzcIJEOTFE) is used for operator-side analytics across multiple sites, suggesting the same operator signal. Searching for this string using an internet scanning service like Shodan identifies 12 IPs at the time of this reporting. Though these IPs are suspected of being part of the DDoS-guard service used by the actor, they are useful datapoints to observe the frequent use of the same PostHog token by the actor.

IP Address	IP Address
65.21.88.152	192.232.50.197
68.178.203.99	192.232.50.5
54.149.62.89	98.84.79.71
54.212.88.2	35.158.27.71
167.86.104.83	195.250.30.188
212.132.75.102

While PostHog is used for analytics, the HTML snippet also explicitly loads a weaponized version of rrweb recorder via a custom script such as rrweb-recorder-20250919-1.js. One such sample was hosted from a customer-operated CloudFront domain, which was removed by AWS following notification from investigators:

hxxps://d2adkz2s9zrlge[.]cloudfront[.]net/rrweb-recorder-20250919-1[.]js

The rrweb-recorder records the user's screen interactions, including every keystroke, mouse movement, scroll, and click in addition to overriding window.fetch and window.XMLHttpRequest to conduct network traffic interception. It does the latter in part by capturing the requestBody and injecting it into the rrweb session log as a custom event. In effect, it uses rrweb as an Adversary-in-the-Middle (AitM) to steal the victim's submitted username, password, and session cookies. It also captures the responseBody so the scammer can steal the resulting authentication token returned by the legitimate server.

Malicious actors frequently embed variations of rrweb into phishing kits (like Evilginx) to capture credentials and MFA tokens in real-time or to replay the session to study how security analysts are interacting with their landing pages.
‍

Hunting for the Ingredients

Four ingredients lined up to make this scam possible:

Mandatory government service
Constrained legitimate access (capacity bottleneck, technical friction, language barrier, geography)
Payment is expected at the .gov site, so an invoice doesn't feel out of place
The signup form happens to harvest a complete identity packet (name, DOB, nationality, doc numbers, address, phone, card).

Any service that hits all four is fair game for an ideal scarcity scam scenario.

Hunting for the ingredients to scarcity scams such as the Mexico one can be challenging due to the dynamic and ambiguous nature of those conditions. Despite being a widespread scam method, they may affect local populations more and therefore may not surface to security researchers through traditional methods such as looking for common scam strings in newly registered domain names and/or observed website titles. AI augmented hunting, however, is well positioned to seek out and identify candidate queries to identify these scarcity scenarios and search for domains that may be preparing to target those scenarios with scams.

A few hypotheses we wanted to research:

Scarcity is universal, scams are local. The same scarcity dynamics recur across countries (passport backlogs, welfare cycles, tax deadlines, immigration bottlenecks). Each country's scam ecosystem is locally branded but thematically identical.
Scarcity timing predicts scam-infrastructure timing. Announce a new digital service or rule change and scammers begin domain registration before citizens have established mental models of the legitimate portal.
One actor often serves multiple scarcity themes. This was identifiable by shared infrastructure fingerprints (NS, Registrar, IP ASN, SSL Issuer) and re-used templates.
‍

Conclusion

Scarcity scams are likely here to stay. As long as government services do not meet the needs of their citizens, there will be a market for scammers to fill the gap and to address the urgency or frustration citizens feel. The scams don’t need to be complex; it's simply social engineering tied to real-world desperation. Desperation that makes even the most careful, smart, and educated people ignore their own intuition and take a risk.

On the flip side, putting up warning banners on government websites does little to nothing to address the root cause.

The traditional way of hunting for these scams and playing whack-a-mole with domain takedowns might be to watch for those notification banners, listen for reports of scam domains, and pivot on reported domains to find similar branded scam domains and websites, but we took a different approach. Instead of chasing common scam themes or looking for security alerts, we researched the conditions that create the scam. By codifying the ingredients (mandatory service, constrained access, payment expectations, and PII harvesting) and offloading the heavy lifting of language-specific query generation and visual inspection to an LLM, we can map entire global scam ecosystems rather than just finding isolated pockets of fraud.

The survey findings suggest that while the branding is often localized, the approach is shared. Whether it’s a passport office in Mexico or a tax portal in Brazil, they are functionally similar.
‍

Sample Findings

Domain	Screenshot	Description
samiaive[.]sbs		Venezuelan health-insurance phishing. Harvests Venezuelan health-insurance credentials for downstream identity/insurance fraud.
certificacion-internacional-gob-ve[.]site		Venezuelan criminal-record,forged-certificate scam targeting Venezuelan emigrants. Used both for PII harvesting and to sell forged criminal-record clearances for migration paperwork.
constanciasmx[.]online		Mexican criminal-record certificate scam. Targets emigrants and job-seekers needing federal antecedentes penales clearance.
digilocker[.]live		Government of India portal with 'New in DigiLocker' cards. Single login captures access to all government-issued digital documents.
epfologinn[.]com epfoporrtal[.]com		Government of India’s Employees' Provident Fund Organisation for direct credential phishing.
aadharcrop[.]com		India Aadhaar/PAN/Voter card 'crop tool' phishing. Designed to harvest Indian government ID documents with passwords — direct identity-theft tooling masquerading as a 'crop tool for CSC centres'.
pmkisanstatuschecks[.]info		India PM Kisan Samman Nidhi spoof. Annual Financial Assistance for Eligible Farmers. Harvests farmer Aadhaar and bank details.
m-parivahan[.]info mparivahan[.]one mparivahanapp[.]digital mparivahanapp[.]help mparivahangov[.]digital mparivahangov[.]help mparivahangov[.]work mparivahanorg[.]help nextgen-mparivahan[.]digital parivahanportal[.]live		India mParivahan Android APK delivery scam. 'NextGen mParivahan / One-stop solution for vehicle and challan services / Check vehicle details, pay traffic fines, and access digital documents — all in one app.’ Downloads an Android Trojan Sha256 hash: 09644b375f92e552653911a6dfda40ada772b6bc15eb4267521bd2c8341af0b1
getschengenvisa[.]com		Schengen-visa appointment scam.
info-tls[.]net info-tlscontact[.]net		Germany and Czechia visa application centre \| TLScontact spoof.
swissvisa-gov[.]com		Fake visa-lottery scheme — Switzerland does NOT run a visa lottery (unlike the US Green Card lottery). Pure advance-fee scam targeting aspiring migrants.
ukvisa-service[.]com		UK visa phishing. Includes a Bangladesh-specific link ('Find out about the visas you can get if you or your family member is from Bangladesh') suggesting targeting.
casestatusalert[.]com		USCIS WhatsApp alerts scam. Targets immigration applicants by promising free WhatsApp notifications on USCIS case status — harvests A-number + WhatsApp phone, then likely monetizes via premium-fee 'expediter' upsells or PII resale.
scis-govt[.]us		USCIS impersonation. 'USA-CIS Independent U.S. Visa Application Assistance.’ Premium-fee fake-immigration-services scam.
ircc-travelassist[.]ca		‘IRCC-TravelAssist' Canadian immigration scam.
consulta-gov-sc[.]top		Brazilian Detran Santa Catarina vehicle phishing.
concursoespcex2026[.]sbs concursopenal-2026[.]sbs concursopenal2026[.]sbs espcexconcurso2026[.]sbs		Brazilian ESPCEX (Army Cadet Officer School) phishing. Possibly to trick victims into making payments for non-existent applications.
digibansos[.]my[.]id		Indonesian welfare credential phishing. Direct harvesting of national ID + password for welfare recipients.
sassastatus-gov[.]co[.]za		South African SASSA status check spoof. Possibly funnels recipients to credential / banking harvest under the guise of helping them check SRD grant status.
brgovoficial[.]com gov-brz[.]com govoficialbr[.]site govportalbr[.]com govseguro[.]com		Brazilian gov[.]br credential phishing. Captures Brazilian government login credential.
mygov-repository-uz[.]ink		Uzbekistan Government document spoof. Phishes the PIN that grants access to an Uzbek citizen's gov-issued document access credentials.
jobici-fr[.]work		French remote-work scam targeting French job seekers — typical 'work from home' lure that asks for upfront fees or PII for fake remote positions.
e-visamontenegro[.]info		Montenegro e-visa spoof. 'Government of Montenegro / Check your Visa status' form requesting Visa reference number, passport number, nationality. Harvests passport + reference data for downstream identity fraud / forged-document sale.
cra-tax-return[.]online		Spoofs Canada Revenue Agency (CRA) / Government of Canada.

‍

Appendix

Mexican Cita Scam Domains:

Domain	Domain
citas-sregob-mx[.]com	online-mx-cita-gob-express[.]com
mx-citas-gob-sre[.]com	pasaporte-mexico-express[.]com
cita-online-mx-gob[.]com	online-mexico-cita-express[.]com
express-citas-sre-gobmx[.]com	gob-mx-pasaporte-cita[.]com
cita-sre-gob-mx[.]com	mx-cita-pasaporte-gob-online[.]com
citas-pasaporte-gobmx[.]com	mx-pasaporte-cita-gob[.]com
citas-gobmx[.]com	express-mexico-online-cita[.]com
cita-sre-pasaporte-mx-gob[.]com	mx-online-cita-express[.]com
citas-sje-gob-mx[.]com	mx-pasaporte-cita-express[.]com
online-pasaporte-cita[.]com	online-mx-gob-cita-express[.]com
gbb-mx-cita-express[.]com	mexico-online-gob-cita[.]com
express-mx-gob-cita[.]com	online-gob-mx-cita-express[.]com
mexico-sre-cita-express[.]com	online-cita-mexico-express[.]com
mx-gob-express-cita[.]com	mx-cita-express-online[.]com
gob-mx-cita-express[.]com	express-mexico-cita[.]com
oficial-cita-express[.]com	pasaporte-mx-cita-online[.]com
cita-mx-pasaporte-gob[.]com	www-online-pasaporte-cita-mx[.]com
mx-cita-sre-gob[.]com	mexico-sre-gob-cita-express[.]com
pasaporte-gobmx-cita-express[.]com	registro-cita-express[.]com
online-mx-citas-express[.]com	onine-pasaporte-cita-mx[.]com
gobmx-citas-express[.]com	express-cita-sre-gob-mx[.]com
express-cita-gobmx[.]com	online-pasaporte-express-cita-mx[.]com
gob-online-cita-express[.]com	mx-pasaporte-express-cita[.]com
gobmx-express-cita[.]com	oficial-express-mx-cita[.]com
sre-mx-cita-express[.]com	mx-online-sre-cita-express[.]com
gobmx-cita-express[.]com	online-gob-cita-express[.]com
express-citas-sre-gob-mx[.]co	online-cita-sre-gob-express[.]com
mx-express-citas-gob-sre[.]com	mx-sre-express-cita-gob[.]com

Scarcity Scams

Domain	Domain
aadharcrop[.]com	mparivahan[.]one
agilizacnh[.]com[.]br	mparivahanapp[.]digital
aires-fgts[.]co	mparivahanapp[.]help
ameli-secu[.]com	mparivahangov[.]digital
application-mygovbd[.]online	mparivahangov[.]help
bolsafamiliabr[.]com	mparivahangov[.]work
bolsafamilianajustica[.]com[.]br	mparivahanorg[.]help
brgovoficial[.]com	mygov-repository-uz[.]ink
calculafgts[.]com[.]br	mygovconnectionassociates[.]com
casestatusalert[.]com	mygovconnectionbrands[.]com
centralguiaveiculars[.]online	mygovconnectioncollective[.]com
certificacion-internacional-gob-ve[.]site	mygovconnectioncompany[.]com
cnhdescomplicada[.]com[.]br	mygovconnectionenterprise[.]com
concursoespcex2026[.]sbs	mygovconnectiongroup[.]com
concursopenal-2026[.]sbs	mygovconnectionhq[.]com
concursopenal2026[.]sbs	mygovconnectionindustries[.]com
constanciasmx[.]online	mygovconnectioninternational[.]com
consulta-gov-sc[.]top	mygovconnectionmanagement[.]com
contesevias[.]com	mygovconnectionnetwork[.]com
cscseva[.]xyz	mygovconnectionoperations[.]com
detransclaim[.]com	mygovconnectionpartners[.]com
digibansos[.]my[.]id	mygovconnectionresources[.]com
digilocker[.]live	mygovconnectionworks[.]com
e-visamontenegro[.]info	mygovt-bd[.]co
efazenda-lpva-ms[.]com	mygovupdates[.]com
epfoin[.]com	nextgen-mparivahan[.]digital
epfologinn[.]com	notificationsservicegov[.]ca
epfoo[.]net	obtain-uspassports-online[.]com
epfoporrtal[.]com	parivahanportal[.]live
espcex2026-seguro[.]sbs	partidacnh[.]com[.]br
espcexconcurso2026[.]sbs	pmkisanstatuschecks[.]info
espcexinscricao[.]sbs	portaldetransito[.]site
especexinscricao2026[.]sbs	regularizafgts[.]com[.]br
fgts-pan[.]co	samiaive[.]sbs
fgts-up[.]co	sassacheckstatus[.]web[.]za
gestoriadigitalmx[.]com	sassastatus-gov[.]co[.]za
getschengenvisa[.]com	sassastatuscheck[.]bar
gov-brz[.]com	secured-traffic-ticket-portal[.]com
govoficialbr[.]site	srdsassastatuscheck350[.]co[.]za
govportalbr[.]com	srdsassastatuscheck[.]net[.]za
govseguro[.]com	sunat123[.]net
guiadacnhbrasil[.]click	swiftfiscaledge[.]live
info-tls[.]net	swissvisa-gov[.]com
info-tlscontact[.]net	syscnh[.]online
ircc-travelassist[.]ca	uidai-login[.]com
italyforretire[.]info	ukvisa-service[.]com
jobici-fr[.]work	usacitizen[.]app
m-parivahan[.]info	uscis-govt[.]us
meuinsslogin[.]com

Scarcity Scams

Wire Fraud and Identity Theft

Hints of Russian Speaking Scammer & AI Generated Scam Content

Identifiers & Registration Pattern

Hunting for the Ingredients

Conclusion

Sample Findings

Appendix

Mexican Cita Scam Domains:

Scarcity Scams

Heading