CMEG Fraud Alert

[jryan 6]

I opened an account with CMElite group At the end of last month. I recevied an email from them saying that I needed to wire funds to them  to start my account. I did and now they say it was a phishing email and not their bank accout. So I am out  bit of money. Just be aware. What I do not understand is how the scammer got my email.

[Abiel 475]

Were you in the process of opening an account with CMEG?

 

[jryan 6]

Yes I was.

[Abiel 475]

That's weird. When is a phishing attempt the email shown does not match the email address. Like servicioalcliente@cfe.gob.mx (shown email) <hotelvalenciapuebla@g-real.net> (real email address). In this case they are tring to appear as cfe.gob.mx, it is a phishing attempt. Does the email match?

[jryan 6]

You know I looked at it, but did not know what a legitimate address from CMEG would say hosting wise. It still begs the question, how did the phisher know I had applied for an account?

The domain is registered in MX... The regiters's name is a known political figure ( from  a quick google) .

I am hoping Chase can help, waiting to hear back from them.

 

Updated headers

 

Received: from netsolhost.com ([10.30.70.109])
    by jax4mhho02.myregisteredsite.com (8.14.4/8.14.4) with ESMTP id x3QL7iEW022682
    (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
    for <[email protected]>; Fri, 26 Apr 2019 17:07:44 -0400
Received: from jax4mhho02.myregisteredsite.com (jax4mhho02.myregisteredsite.com. [64.69.218.78])
        by mx.google.com with ESMTP id y83si13708879ywy.313.2019.04.26.14.07.45
        for <[email protected]>;
        Fri, 26 Apr 2019 14:07:46 -0700 (PDT)
Received: (from 2012724.2202314@localhost)
    by atl4vux178.mgt.hosting.qts.netsol.com (8.14.9/8.14.9/Submit) id x3QL5w9L014891;
    Fri, 26 Apr 2019 17:05:58 -0400
Received: from atl4vux178.mgt.hosting.qts.netsol.com (localhost [127.0.0.1])
    by netsolhost.com (8.14.9/8.14.9) with ESMTP id x3QL7cLk016018
    for <[email protected]>; Fri, 26 Apr 2019 17:07:39 -0400
Received: by 2002:a02:942e:0:0:0:0:0 with SMTP id a43csp1232686jai;
        Fri, 26 Apr 2019 14:07:46 -0700 (PDT)
Reply-To: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: CMElitegroup Funding Required
Date: Fri, 26 Apr 2019 17:05:58 -0400
Message-ID: <201904262105.x3QL5w9L014891@atl4vux178.mgt.hosting.qts.netsol.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0082_01D4FCFF.49230980"
X-Mailer: Microsoft Outlook 16.0
X-Google-Smtp-Source: APXvYqy6KUZk+PJm+xSLRP2kDURkUkUDYMV+Qhhvoo4Jb+D+R5+uwKrlQ3mvu4B1P+LOqz9Cab8c
X-Received: by 2002:a25:ba44:: with SMTP id z4mr24863761ybj.304.1556312866194;
        Fri, 26 Apr 2019 14:07:46 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 64.69.218.78 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
X-vuxuser: 2012724.2202314
Thread-Index: AQIum3WnMQlyUM2Z0I1WnMnzaJk6OQ==
X-OlkEid: 0000000051545DED5894D247AF62D77A0C75E1C50700C3B68E10F77511CEB4CD00AA00BBB6E600000000000C00004797873332435C4A997A4994BB1A31250000000004030000FF2141CBBDF2B04D809C0BEFFC9AE7C9

 

Edited May 9, 2019 by jryan

[jryan 6]

FYI A legitimate header from CMEG.

Received: by filter1785p1mdw1.sendgrid.net with SMTP id filter1785p1mdw1-8560-5CD43486-D
        2019-05-09 14:09:10.270879145 +0000 UTC m=+61493.852927894
Received: from o22.email.freshdesk.com (o22.email.freshdesk.com. [198.37.146.34])
        by mx.google.com with ESMTPS id s25si1150037ejb.45.2019.05.09.07.09.11
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Thu, 09 May 2019 07:09:12 -0700 (PDT)
Received: from ec2-54-152-41-238.compute-1.amazonaws.com (EHLO freshdesk.com) ([54.152.41.238])
          by smtpout.freshdesk.com (Freshworks SMTP Server) with ESMTPA ID -2003050784.2
          for <[email protected]>;
          Thu, 09 May 2019 14:09:09 +0000 (UTC)
Received: from freshdesk.com (mail-us1.freshemail.io [34.198.193.174])
    by ismtpd0010p1iad1.sendgrid.net (SG) with ESMTP id BxTOg57kTReVA4LnBcL5Qw
    for <[email protected]>; Thu, 09 May 2019 14:09:10.179 +0000 (UTC)
Received: by 2002:a02:942e:0:0:0:0:0 with SMTP id a43csp928843jai;
        Thu, 9 May 2019 07:09:12 -0700 (PDT)
Reply-To: "Technical Support Department" <[email protected]>
From: "Technical Support Department" <[email protected]>
To: <[email protected]>
References: <[email protected]>
In-Reply-To: <[email protected]>
Subject: Re: Funds Return
Date: Thu, 9 May 2019 10:09:10 -0400
Message-ID: <5cd434859630a_1c3b33a4ec421750493.sidekiq-email-2@email.freshdesk.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0039_01D50651.EB7E2C90"
X-Mailer: Microsoft Outlook 16.0
X-Google-Smtp-Source: APXvYqxhXb0gK+Z3jCdWKEPjgSiwx04mYlcw7XcWfcifee5odytDvY9VnVcUC9nQlgu6JEx0V7de
X-Received: by 2002:a50:fa90:: with SMTP id w16mr4232148edr.184.1557410952498;
        Thu, 09 May 2019 07:09:12 -0700 (PDT)
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=s1 header.b="L/i3qTgZ";
       spf=pass (google.com: domain of [email protected] designates 198.37.146.34 as permitted sender) smtp.mailfrom="[email protected]";
       dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=cmelitegroup.com
X-SG-EID: oWqmDDdaJUP6F8BER4IIXRrvIE4alLZDvz4xwcqOERmfgkkBNcV6JFCvjrMI6PntqcQ8kffT/+3X4q
 Lavg6q+8aX6ERgZR27Rc0RhfhNrRXpjJ6iPcEYyynr0Ae5A9x5qH9UsQyD7fLqFbySUPPbSvEwTp1k
 yB7XAN/kKHjAo/tIZCpfsA31drsyTy7EexgrqaiA+dAcVqF/CTMCUgHZlOcL0lA02VJ/ApmVmXttbZ
 fV7he5+4NGcnKsKJADT/jm
X-SG-ID: dXNuuxiaeVPHPf1dZH02eMwsfa6bAlZzsGXadGBoPofe2+h32Y2/Y4hgUEWaDouBVS8aPaHE+0BrpV
 6BTyePc/k4C7ktdaCJlKT58aI2k1+Dg/Zt54UlZbrP9hK0PD5Y86iUBkqt0aXPo76CWl6N+S+pPR5n
 iGF4mLLCdEe46wZS6Yp+i3ywcsc+gZfiN2WFw+b+VVSnR3JGsXaR5s3Lx0GEve7+CKJJom+6eONODF
 AaXv8EQUOTYUAZ5KyXNnbdZnNTXxIIMc9b4M6WE5EiAhKjCx+TDe44gsZM5AlIVX1zCOMbRdnkMsZ8
 WQkhY4ZdYQNhu9sbuEz7+GDte2BxzOcfjswZWpE0lwG0OIQ5pD5KmUp6eFgufHgIvHZKOjfgJ147jk
 jVUxcQHxwSe0y8oR7w2SeATe7HSQB9C9qaa6lr633po1YcSYnPv8EBg5jFMl/ijzhwRaVlsvCovKiT
 uQ==
Thread-Index: AQEPqwG8RH0VvnVmF4BEzkavVKhmBAMLJAlI

 

 

I see now that the text in Red wasn't in the phish header 😞  Nor the text follwoeing that.

[Abiel 475]

Damn, I hope Chase can help you. 

[Andrew Aziz 98]

This is important for members to know. Please show this in community so people can be aware. 

[Sheela 31]

I am in a process of opening new account with them. Did received below phishing email which looked like legitimate address with the domain ([email protected]) right after checking with them on account status. Few minutes later received another notification email  stating "phishing detected" and not to respond what they mention in the below(phishing) email. Have proceeded only once I received new account details with login credentials, once we login they have given details on transferring funds etc...since it is offshore I just initiated to transfer only $500+fees. Once that is cleared then only I will attempt to transfer more. waiting on it!

[jryan 6]

Same as what I received. It is because of the quickness of the phish after contacing CMEG that makes me suspect CMEG system is compromised.

[Gordon Freaman 10]

@Sheela "To login and access the platform your account must be funded" - these words should fire an alert in everyone's mind I guess 🙂 

It will be super hard to find a broker who wants you to fund an account before they give you username and password. It doesn't even compute. 

[Sheela 31]

@Aznari R,  That is a great point! This is new account creation request that I submitted to CMEG. As they have 2 different platforms to choose from(DAS and Sterling) which will be tied to our CMEG broker account. This account need to be funded in order to active the chosen platform. Will see how it works with them:) So far no issues..

 

[walidmahmoud 0]

Hi Sheela ,

do you have any update on funding your account and how did you go so far ?

[walidmahmoud 0]

and is the phishing email looks as the same as the original (correct one) or there was differences ?

[Sheela 31]

1 hour ago, walidmahmoud said:

Hi Sheela ,

do you have any update on funding your account and how did you go so far ?

@walidmahmoud CMEG Staff is nice to work with but not worth of my time and effort. That is still in progress as of today. First wire failed due to info not matching from source to destination, second attempt is still in progress(small amount).