Whenever a government service has constrained supply (slot scarcity, queue, complexity, deadline pressure) against motivated demand, an arbitrage opportunity exists. Citizens are willing to pay extra to jump the queue, get a faster slot, or take a shortcut. Where official supply doesn't expand to meet that willingness to pay, someone fills the gap. Sometimes it's a legitimate expediter, but more often, it's a scam.
The following shows a years-long campaign targeting Mexican citizens with a scam themed as a fast track service for government documents they branded as “Mexican Cita Express” or “Cita Express SRE México”. This scam alleges there is a fast track service to process government documents. In reality there is no official Mexican Cita Express or the like. The scam theme has continued for years using the same branding and themes due to the persistent government inefficiencies maintaining the scarcity for the scam to thrive. Because citizens can’t get appointments through legitimate pathways, citizens will often seek out other ways to access these services. Instead, they end up paying scammers in addition to giving away their personal information in the process.
Wire Fraud and Identity Theft
To appear legitimate, the initial fraudulent fee ranges from $1,730 to $4,120 MXN, mirroring the real Secretaría de Relaciones Exteriores (Mexican Ministry of Foreign Affairs) passport pricing. After payment, the site fabricates additional bureaucratic obstacles including the need for 'Biometric Validation', 'Identity Depuration' and 'Final Release'. These obstacles pressure victims into making up to five additional transfers totaling $11,360 MXN. All victim data, including their Mexican national identification code, name, email address, phone number, and bank transfer receipt, is sent in real time to an operator-controlled Telegram bot. It is worth noting that older versions of this scam used PostHog site tracking and rrweb-recorder (Record and Replay the Web) to record every user interaction on the site. The newer Telegram bot approach likely allows the scammer to operate more asynchronously and autonomously by integrating AI workers into their scam workflows.
If all extortion stages are completed, the full per-victim financial exposure is $13,090–$15,480 MXN (approximately $650–$770 USD). Beyond the direct financial loss, the collection of Mexico's primary national identity number, Clave Única de Registro de Población (CURP), creates a downstream identity-theft risk. CURP is used as a Know Your Customer (KYC) control by Mexican financial institutions, meaning harvested CURP data can enable account fraud well after the immediate scam concludes.
The site code was seen to have hardcoded bank info which are likely scammer-controlled Mexican bank accounts the victim sees when they hit the "pay your passport fee" step. However, we suspect these are compromised or mule accounts. The fee for a real SRE passport appointment should go to the Mexican Treasury bank account, but this endpoint substitutes it with a hardcoded mule account. Several of these mule accounts were seen hardcoded into the various scam website’s code and are likely used to receive the stolen money from victims then forward onto laundering services.
From the site code standpoint, the fraud works in the following order:
- Front end: pixel-perfect clone of the real SRE "Cita Express" portal (logo, palette, layout). The clone source is mexformclone.emergent.host. Emergent is an AI no-code app-builder platform used by the attacker to build a passable-enough, low-cost SRE replica there
- Inline JS interceptor, planted at the top of <head> BEFORE React loads:
- Replaces window.fetch
- When the React app calls mexformclone.emergent[.]host/api/bank-details (the real source bank details), this interceptor blocks the external call and re-routes to local /api/bank-details, which then returns the fraudulent CLABE above.
- Comments are in Russian such as “КРИТИЧЕСКОЕ ИСПРАВЛЕНИЕ: Блокируем внешний API ПЕРВЫМ ДЕЛОМ! Это предотвращает загрузку чужих реквизитов из внешнего источника”. Translation: "CRITICAL FIX: Block external API FIRST! This prevents loading OTHER people's [bank] details from external source".
- Telegram-bot exfil: Their form data is posted to /api/telegram.php. It captures PII data including names, CURP (Mexican national ID), appointment office, dates, payment amounts.
- Session recording of every victim via rrweb library (loaded from a customer-operated CloudFront distribution) and full keystroke/mouse playback for live monitoring and quality control.
- Social-engineering urgency layer:
- payment-text-replacer.js swaps in an "Aviso Importante" modal saying the victim has 30 minutes to pay or face a 12-month suspension.
- confirmation-form-enhancer.js injects extra name fields and locks the "Confirmar pago" button until they're filled, maximizing data collection.
- payment-handler.js redirects to /upload-receipt.html after click and exfiltrates again via keepalive POSTs (so the egress survives navigation).
Hints of Russian Speaking Scammer & AI Generated Scam Content
Interestingly, the scam site code sets a +03:00 timezone in an “updated_at” variable, which is Moscow time. There is extensive use of Russian language comments throughout the site along with the use of various emojis. Both the extensive comments and emojis are common identifiers for AI generated content.
Identifiers & Registration Pattern
- Website Title: Cita Express - SRE México
- Email domain:
- ddos-guard[.]net
- ordertld[.]com
- Registrar: CNOBIN INFORMATION TECHNOLOGY LIMITED
- IP ISP: Iqweb Fz-llc
- Server Type: ddos-guard
Often, multiple domains are grouped on the same IP addresses (domains list in Appendix)
| IP Address | IP Address |
|---|---|
| 186.2.175.75 | 186.2.175.63 |
| 186.2.175.77 | 185.149.120.203 |
| 186.2.175.21 | 186.2.175.17 |
These scams involving the Mexican government’s official passport application page have been going on for years, and a recent report by ESET in January 2026 mentions similar scam sites followed by an advisory by Mexico’s Ministry of Foreign Affairs. Despite this, the same scam continues, likely because the same government inefficiencies continue to impact citizens in need of those government services.
As it became apparent in this investigation, this activity has been reported on repeatedly with no meaningful change in behaviors by the scammers or changes by the government to address their role in the scams. Instead, we turn our attention to exploring the nature and conditions of these scams and hunting for other government-imposed scarcity scams like this one.
A PostHog token (phc_yJW1VjHGGwmCbbrtczfqqNxgBDbhlhOWcdzcIJEOTFE) is used for operator-side analytics across multiple sites, suggesting the same operator signal. Searching for this string using an internet scanning service like Shodan identifies 12 IPs at the time of this reporting. Though these IPs are suspected of being part of the DDoS-guard service used by the actor, they are useful datapoints to observe the frequent use of the same PostHog token by the actor.
| IP Address | IP Address |
|---|---|
| 65.21.88.152 | 192.232.50.197 |
| 68.178.203.99 | 192.232.50.5 |
| 54.149.62.89 | 98.84.79.71 |
| 54.212.88.2 | 35.158.27.71 |
| 167.86.104.83 | 195.250.30.188 |
| 212.132.75.102 |
While PostHog is used for analytics, the HTML snippet also explicitly loads a weaponized version of rrweb recorder via a custom script such as rrweb-recorder-20250919-1.js. One such sample was hosted from a customer-operated CloudFront domain, which was removed by AWS following notification from investigators:
- hxxps://d2adkz2s9zrlge[.]cloudfront[.]net/rrweb-recorder-20250919-1[.]js
The rrweb-recorder records the user's screen interactions, including every keystroke, mouse movement, scroll, and click in addition to overriding window.fetch and window.XMLHttpRequest to conduct network traffic interception. It does the latter in part by capturing the requestBody and injecting it into the rrweb session log as a custom event. In effect, it uses rrweb as an Adversary-in-the-Middle (AitM) to steal the victim's submitted username, password, and session cookies. It also captures the responseBody so the scammer can steal the resulting authentication token returned by the legitimate server.
Malicious actors frequently embed variations of rrweb into phishing kits (like Evilginx) to capture credentials and MFA tokens in real-time or to replay the session to study how security analysts are interacting with their landing pages.
Hunting for the Ingredients
Four ingredients lined up to make this scam possible:
- Mandatory government service
- Constrained legitimate access (capacity bottleneck, technical friction, language barrier, geography)
- Payment is expected at the .gov site, so an invoice doesn't feel out of place
- The signup form happens to harvest a complete identity packet (name, DOB, nationality, doc numbers, address, phone, card).
Any service that hits all four is fair game for an ideal scarcity scam scenario.
Hunting for the ingredients to scarcity scams such as the Mexico one can be challenging due to the dynamic and ambiguous nature of those conditions. Despite being a widespread scam method, they may affect local populations more and therefore may not surface to security researchers through traditional methods such as looking for common scam strings in newly registered domain names and/or observed website titles. AI augmented hunting, however, is well positioned to seek out and identify candidate queries to identify these scarcity scenarios and search for domains that may be preparing to target those scenarios with scams.
A few hypotheses we wanted to research:
- Scarcity is universal, scams are local. The same scarcity dynamics recur across countries (passport backlogs, welfare cycles, tax deadlines, immigration bottlenecks). Each country's scam ecosystem is locally branded but thematically identical.
- Scarcity timing predicts scam-infrastructure timing. Announce a new digital service or rule change and scammers begin domain registration before citizens have established mental models of the legitimate portal.
- One actor often serves multiple scarcity themes. This was identifiable by shared infrastructure fingerprints (NS, Registrar, IP ASN, SSL Issuer) and re-used templates.
Conclusion
Scarcity scams are likely here to stay. As long as government services do not meet the needs of their citizens, there will be a market for scammers to fill the gap and to address the urgency or frustration citizens feel. The scams don’t need to be complex; it's simply social engineering tied to real-world desperation. Desperation that makes even the most careful, smart, and educated people ignore their own intuition and take a risk.
On the flip side, putting up warning banners on government websites does little to nothing to address the root cause.
The traditional way of hunting for these scams and playing whack-a-mole with domain takedowns might be to watch for those notification banners, listen for reports of scam domains, and pivot on reported domains to find similar branded scam domains and websites, but we took a different approach. Instead of chasing common scam themes or looking for security alerts, we researched the conditions that create the scam. By codifying the ingredients (mandatory service, constrained access, payment expectations, and PII harvesting) and offloading the heavy lifting of language-specific query generation and visual inspection to an LLM, we can map entire global scam ecosystems rather than just finding isolated pockets of fraud.
The survey findings suggest that while the branding is often localized, the approach is shared. Whether it’s a passport office in Mexico or a tax portal in Brazil, they are functionally similar.
Sample Findings
Appendix
Mexican Cita Scam Domains:
| Domain | Domain |
|---|---|
| citas-sregob-mx[.]com | online-mx-cita-gob-express[.]com |
| mx-citas-gob-sre[.]com | pasaporte-mexico-express[.]com |
| cita-online-mx-gob[.]com | online-mexico-cita-express[.]com |
| express-citas-sre-gobmx[.]com | gob-mx-pasaporte-cita[.]com |
| cita-sre-gob-mx[.]com | mx-cita-pasaporte-gob-online[.]com |
| citas-pasaporte-gobmx[.]com | mx-pasaporte-cita-gob[.]com |
| citas-gobmx[.]com | express-mexico-online-cita[.]com |
| cita-sre-pasaporte-mx-gob[.]com | mx-online-cita-express[.]com |
| citas-sje-gob-mx[.]com | mx-pasaporte-cita-express[.]com |
| online-pasaporte-cita[.]com | online-mx-gob-cita-express[.]com |
| gbb-mx-cita-express[.]com | mexico-online-gob-cita[.]com |
| express-mx-gob-cita[.]com | online-gob-mx-cita-express[.]com |
| mexico-sre-cita-express[.]com | online-cita-mexico-express[.]com |
| mx-gob-express-cita[.]com | mx-cita-express-online[.]com |
| gob-mx-cita-express[.]com | express-mexico-cita[.]com |
| oficial-cita-express[.]com | pasaporte-mx-cita-online[.]com |
| cita-mx-pasaporte-gob[.]com | www-online-pasaporte-cita-mx[.]com |
| mx-cita-sre-gob[.]com | mexico-sre-gob-cita-express[.]com |
| pasaporte-gobmx-cita-express[.]com | registro-cita-express[.]com |
| online-mx-citas-express[.]com | onine-pasaporte-cita-mx[.]com |
| gobmx-citas-express[.]com | express-cita-sre-gob-mx[.]com |
| express-cita-gobmx[.]com | online-pasaporte-express-cita-mx[.]com |
| gob-online-cita-express[.]com | mx-pasaporte-express-cita[.]com |
| gobmx-express-cita[.]com | oficial-express-mx-cita[.]com |
| sre-mx-cita-express[.]com | mx-online-sre-cita-express[.]com |
| gobmx-cita-express[.]com | online-gob-cita-express[.]com |
| express-citas-sre-gob-mx[.]co | online-cita-sre-gob-express[.]com |
| mx-express-citas-gob-sre[.]com | mx-sre-express-cita-gob[.]com |
Scarcity Scams
| Domain | Domain |
|---|---|
| aadharcrop[.]com | mparivahan[.]one |
| agilizacnh[.]com[.]br | mparivahanapp[.]digital |
| aires-fgts[.]co | mparivahanapp[.]help |
| ameli-secu[.]com | mparivahangov[.]digital |
| application-mygovbd[.]online | mparivahangov[.]help |
| bolsafamiliabr[.]com | mparivahangov[.]work |
| bolsafamilianajustica[.]com[.]br | mparivahanorg[.]help |
| brgovoficial[.]com | mygov-repository-uz[.]ink |
| calculafgts[.]com[.]br | mygovconnectionassociates[.]com |
| casestatusalert[.]com | mygovconnectionbrands[.]com |
| centralguiaveiculars[.]online | mygovconnectioncollective[.]com |
| certificacion-internacional-gob-ve[.]site | mygovconnectioncompany[.]com |
| cnhdescomplicada[.]com[.]br | mygovconnectionenterprise[.]com |
| concursoespcex2026[.]sbs | mygovconnectiongroup[.]com |
| concursopenal-2026[.]sbs | mygovconnectionhq[.]com |
| concursopenal2026[.]sbs | mygovconnectionindustries[.]com |
| constanciasmx[.]online | mygovconnectioninternational[.]com |
| consulta-gov-sc[.]top | mygovconnectionmanagement[.]com |
| contesevias[.]com | mygovconnectionnetwork[.]com |
| cscseva[.]xyz | mygovconnectionoperations[.]com |
| detransclaim[.]com | mygovconnectionpartners[.]com |
| digibansos[.]my[.]id | mygovconnectionresources[.]com |
| digilocker[.]live | mygovconnectionworks[.]com |
| e-visamontenegro[.]info | mygovt-bd[.]co |
| efazenda-lpva-ms[.]com | mygovupdates[.]com |
| epfoin[.]com | nextgen-mparivahan[.]digital |
| epfologinn[.]com | notificationsservicegov[.]ca |
| epfoo[.]net | obtain-uspassports-online[.]com |
| epfoporrtal[.]com | parivahanportal[.]live |
| espcex2026-seguro[.]sbs | partidacnh[.]com[.]br |
| espcexconcurso2026[.]sbs | pmkisanstatuschecks[.]info |
| espcexinscricao[.]sbs | portaldetransito[.]site |
| especexinscricao2026[.]sbs | regularizafgts[.]com[.]br |
| fgts-pan[.]co | samiaive[.]sbs |
| fgts-up[.]co | sassacheckstatus[.]web[.]za |
| gestoriadigitalmx[.]com | sassastatus-gov[.]co[.]za |
| getschengenvisa[.]com | sassastatuscheck[.]bar |
| gov-brz[.]com | secured-traffic-ticket-portal[.]com |
| govoficialbr[.]site | srdsassastatuscheck350[.]co[.]za |
| govportalbr[.]com | srdsassastatuscheck[.]net[.]za |
| govseguro[.]com | sunat123[.]net |
| guiadacnhbrasil[.]click | swiftfiscaledge[.]live |
| info-tls[.]net | swissvisa-gov[.]com |
| info-tlscontact[.]net | syscnh[.]online |
| ircc-travelassist[.]ca | uidai-login[.]com |
| italyforretire[.]info | ukvisa-service[.]com |
| jobici-fr[.]work | usacitizen[.]app |
| m-parivahan[.]info | uscis-govt[.]us |
| meuinsslogin[.]com |