This is really just a pointer to a blog article published elsewhere on the topic of an annoying Swiss spammer apparently based in Latin America.
Apparent senders:
$ grep '^From:' Mail/scientificspam.ke-i | sort | uniq From: D Fazel <fazel@journals.ke-i.org> From: "Dr. Kateryna Bielka, M.D." <bielka@journals.ke-i.org> From: "Dr. Kateryna Bielka, M.D." <kateryna.bielka@journals.ke-i.org> From: "Dr. Kateryna Bielka, M.D." <k.bielka@journals.ke-i.org> From: "Dr. Lisseth Tovar, M.D." <lisseth.tovar@internalmedicinereview.org> From: "Dr. Lisseth Tovar, M.D." <l.tovar@internalmedicinereview.org> From: "Dr. Lisseth Tovar, M.D." <tovar@internalmedicinereview.org> From: "Koen, Reni" <rkoen@journals.ke-i.org> From: "Mihaleva, Milena" <milena.mihaleva@internalmedicinereview.org>
Related Scientific Spam listings:
$ check 179.43.141.109 179.43.141.109 A 127.0.0.2 TXT "[FAZEL] Followup Article rkoen@journals.ke-i.org 20160430" $ check 179.43.141.96 179.43.141.96 A 127.0.0.2 TXT "[FAZEL] /27 escalation - Dylan Fazel / ke-i.org / internalmedicinereview.org / zel.li nomail@example.org 20160430" $ check 179.43.141.6 179.43.141.6 A 127.0.0.2 TXT "[FAZEL] /24 escalation - Dylan Fazel - see https://scholarlyoa.com/2016/08/04/about-those-manipulative-spam-emails-from-internal-medicine-review/ for discussion nomail@example.org 20160906" $ check internalmedicinereview.org ke-i.org zel.li internalmedicinereview.org A 127.0.1.2 TXT "[FAZEL] Followup Article rkoen@journals.ke-i.org 20160430" ke-i.org A 127.0.1.2 TXT "[FAZEL] Re: Manuscript Submission [MRA] fazel@journals.ke-i.org 20150526" zel.li A 127.0.1.2 TXT "[FAZEL] Followup Article rkoen@journals.ke-i.org 20160430"
IP WHOIS:
[whois.lacnic.net] inetnum: 179.43.141.96/27 status: reallocated owner: Private Layer Switzerland ownerid: CH-PLSW-LACNIC responsible: Ezequiel Pineda address: Ocean Business Plaza, Piso 17 Suite 1703, , address: 00000 - Zurich - CH country: CH phone: +507 8365601 [32] owner-c: TSD2 tech-c: TSD2 abuse-c: TSD2 created: 20131218 changed: 20131218 inetnum-up: 179.43.128/18
Domain WHOIS:
[whois.nic.li] whois: This information is subject to an Acceptable Use Policy. See https://www.nic.ch/terms/aup/ Domain name: zel.li Holder of domain name: Dylan FAZEL 340 S Lemon Ave 7750 US-91789 Walnut United States Contractual Language: French Technical contact: FAZEL Dylan 340 S Lemon Ave 7750 US-91789 WALNUT United States Registrar: NETIM First registration date: 2008-09-19 DNSSEC:N Name servers: ns1.zel.li [179.43.141.109]
Lisseth hangs / was hanging out in Morocco at the time she made a dishonest delisting request to Sci Spam.
From lisseth.tovar@internalmedicinereview.org Tue Aug 2 08:01:39 2016 Received: from server.zel.li (server.zel.li [179.43.141.109]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by homiemail-mx5.g.dreamhost.com (Postfix) with ESMTPS id B26B215627E for <rocket.scientists@scientificspam.net>; Tue, 2 Aug 2016 01:01:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=internalmedicinereview.org; s=default; h=Content-Type:MIME-Version:Subject: Message-ID:To:From:Date:Sender:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=qISH+8mtZ66Dw248r6oPuln8KK+Pn9Y1YMT//zLU3Ng=; b=updeUjPalHn39BRa/KVfRGWx9m4fdX60QOZqu50wN/iAgg2MznoDSq+4dCr6EzziYfNvkHP4QDa5pDo3uI52h1Wwxu/wgTs6afqvYw4YV2uisiPF7U3YPql7FE/QNzB4vQwiDvlIL290agzdil1XwNU2gAkHQtEcWJDDHUOuf7fm4Dcj38TPwGYeUJimhsz/gMtwaKrBSBLT1KT600N0pe6TRXG/OpAlDYozRCv91otKfC8hTgRlVgHpOdRotIhXyV5Wc7jiXOFJvGsCInwrvYmCJlKEkT+DviwLyHMO0iO2794/mmPVW2jXBlgVh8cKWz6168leYX5GTNZ1OGKTyQ==; Received: from adsl196-10-240-217-196.adsl196-16.iam.net.ma ([196.217.240.10]:62463 helo=Macs-MacBook-Air.local) by server.zel.li with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-SHA384:256) (Exim 4.87) (envelope-from <lisseth.tovar@internalmedicinereview.org>) id 1bUUgw-0003fE-3w for rocket.scientists@scientificspam.net; Tue, 02 Aug 2016 12:04:48 +0400 Date: Tue, 2 Aug 2016 09:01:31 +0100 From: "Dr. Lisseth Tovar M.D." <lisseth.tovar@internalmedicinereview.org> To: rocket.scientists@scientificspam.net Message-ID: <etPan.57a0535b.6b189869.3cc6@Macs-MacBook-Air.local> Subject: IP removal request X-Mailer: Airmail (351) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="57a0535b_154abb0_3cc6" X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server.zel.li X-AntiAbuse: Original Domain - scientificspam.net X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - internalmedicinereview.org X-Get-Message-Sender-Via: server.zel.li: authenticated_id: lisseth.tovar@internalmedicinereview.org X-Authenticated-Sender: server.zel.li: lisseth.tovar@internalmedicinereview.org Status: RO X-Status: A Content-Length: 2478 Lines: 48 Hello, we are requesting that you please remove IP 179.43.141.109 from your list. We were sending some non-commercial cold emails to some physicians and researchers who have journal articles on PubMed that are of interest to editors of our medical journals. We have since cleaned our lists. Please let me know if you would like additional information. Thank you, Lisseth Tovar Internal Medicine ReviewOur prompt response:
Of course, the spam keeps coming in, both to unmanned spamtraps we monitor as well as those of actual live scientists reporting in the thread on Dr Beall’s blog.
http://for-sci-law.blogspot.com/2015/12/the-proliferation-of-flaky-academic.html
http://eusa-riddled.blogspot.com/2016_08_07_archive.html
Thanks for the link to Riddled!
Lisseth has spammed me repeatedly in the last few weeks, but it’s the same old bullsh1t story in which she lies about following up previous correspondence. Time for a new script, people!
You’re welcome. Thank *you*.
Yes, our spamtraps are witnessing the same, and over on Beall’s blog, more and more people are coming forward with reports of the same.
Received: from server.zel.li (server.zel.li [77.79.248.75])
…to no effect whatsoever, so listed in its entirety.
Yup. I was pretty disgusted by the blatant lie (“We talked some months ago…”). Without that, this would just be run of the mill spam.
-MMM
1/16/17
Dear Dr. XXX,
I wish you a happy new year. We talked some months ago about the idea of publishing a followup article to the one you authored entitled “XXX.”. Is now a better time for you to write something? Is there anything I can do to help? If now isn’t the right time for you to work on a followup to this article, I would certainly be interested in knowing more about your current research.
I will tell you more about the journal in case you don’t still have our earlier emails. The Internal Medicine Review is a hybrid journal with optional open access. The issues are monthly, and published both online and in print. The submission deadline is flexible.
Please get back to me at your earliest convenience.
Sincerely,
Dr. Lisseth Tovar
Senior Editor
Internal Medicine Review (IMR)
Yep, I just got that one today. Exact same email with my name and my journal article in the XXX spaces. It’ about the 5th email I’ve received from them.
I’ve got the spam from Lisseth today….still active spam!
So have our spamtraps. Yeah, no sign of the operation stopping.
As with most of our “target group,” the spam volume is so low, and the targeting so good (yeah, not really that fantastic, but “scientists of any sort,” rather than “anything with an email address”) that the generic spam blocklists will never notice these folks; using the ScientificSpam DNSBLs on a mail server may be the only scalable manner of allowing email recipients not to receive such email at all.
I got the same e-mail today and I have received three of four other bogus e-mails from her before.
She keeps changing her e-mail address so that she gets through my Blocked Sender list.
Perhaps you could mention our existence to your mail admins – your site is one of the lucky few who haven’t outsourced to Office 365, or Google, yet.
Thanks for this thread! Got the spam today.
Thanks so much. Got the spam today
Have been spammed as well asking whether I was “still interested” in preparing a manuscript for Internal Medicine. Not sure whether to reply and say “not relevant for a psychologist” or just to ignore and wait for it /her/them to go away.
We recommend neither. Replies to spam confirm your address is live and a good target for more spam. They are also not going to go away. What you can do is to talk to the email administrators of your university/institute and ask them to prevent the reception of email from this spammer to you and all others.
They can either do it on their own – or they would be most welcome to configure their systems to consult our free services. Both of the entities involved in your case operate their own, so they are still holding the reins (unlike other similar entities who have e.g. outsourced to Microsoft or Google).
We would be delighted to discuss with them; please let them know rocket dot scientists at scientificspam dot net will gladly answer any question they might have regarding the use of our services.
She keeps it coming…:
“Dear Dr. xxxx,
I realized that our system and process may not be that easy-to-understand. Hence, I am happy to assist you in all the ongoing processes during submission, peer-reviews and other stages of scientific publication.
Do you have any questions at this point?
Sincerely,
Dr. Lisseth Tovar
Senior Editor
Internal Medicine Review (IMR)
http://www.internalmedicinereview.org“
Lisseth cares about me too!! It’s like I’m a real boy!
Talking to IT today.
Spam solicitation received today – wants to know if I’ll write a f/u to an article published last year.
I got more of the same spam today. Since my research and the specific article they requested f/u on are completely unrelated to the journal title being touted (Internal Medicine Review), I presume the operation is running a bot that clips author names, email addresses, and titles and inserts them into email and text for mass distribution.
Unlike most phishing efforts, this is written in perfect English and might be dangerous to the unwary.
We think you’re right with respect to the targeting policies of the Dylan Fazel operation.
It’s not phishing as far as we can see, though, just run-of-the-mill Scientific Spam.
With reference to earlier comment https://scientificspam.net/?p=333#comment-27610
Hmm
Another /21 to be listed.
I got the same spam!
###
July 7, 2017
Dear Dr. XXX,
One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “XXXXXX.”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.
Would you or perhaps one of your students have time to contribute an article over the summer?
Sincerely,
Lisseth Tovar, M. D.
Senior Editor
Internal Medicine Review
http://www.internalmedicinereview.org
Dear Dr. MY NAME,
One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “MY PAPER, 2016”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.
Would you or perhaps one of your students have time to contribute an article over the summer?
Sincerely,
Lisseth Tovar, M. D.
Senior Editor
Internal Medicine Review
http://www.internalmedicinereview.org
This email and attachments sent with it are confidential and intended only for the use by the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not read, distribute or copy this e-mail. Please notify the sender immediately by e-mail or at 712 H Street Suite 1018 Washington DC 20002 USA. If you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
Spam. Lisseth Tovar, M. D. is dragging his/her name through the mud.
But that’s okay because it’s a fake name anyway.
I’ve recieved the same solicitation from Dr. Katryna Bielka and was about to spend significant time putting together a manuscript – am I to understand this is bullshit?? I even filled in an online form with the title, authors, and abstract for my article, and entered an agreed-upon reduced publication fee (that she very easily reduced by 60% as I am a new postdoc and have no extra funding). I didn’t supply any credit card info, but I just want to know if this is a waste of time before spending valuable hours composing a manuscript for nothing… here is a copy of some of her emails:
Dear Dr. Dr. XX [notice the double Dr…. way to fill in your generic email properly…],
I hope you are enjoying the start of the new year. We were in contact a few months ago about your paper entitled “XXXXX.”. I wanted to check-in with you again about the possibility of publishing a followup/update to this paper in one of the next issues of the Medical Research Archives. I still think that such an article could be of much interest to our readers and am hoping that you are in a better position to write something now that the new year is starting. The length of the article and timing of submission are flexible. If there is any way I can assist in making this happen please do not hesitate to ask.
Would you be available to proceed with this in the next 2-3 months?
Sincerely,
Dr. Kateryna Bielka, M. D.
Senior Editor
Medical Research Archives
http://www.journals.ke-i.org/mra
What do I do??????
Also here is a link tot he online form: https://www.cognitoforms.com/KEI7/MRAManuscriptRegistrationForm
Thank you, Cognito Forms.
It is our advice that you ignore these spammers completely. You do whatever you want, but do read up on them. You could for example check out @Neuro_Skeptic on Twitter to have a second opinion…
Hello,
Just received similar spam from Kateryna Bielka, M. D. on behalf of Medical Research Archives. What distinguished this one from others I receive is the largely correct grammar…no real red flags there. Also, it did not lie about previous correspondence…it seemed to be written as a legit request would be Body of message follows:
“I hope all is well. An article you authored a while back entitled “XXX” caught my interest and I thought I would contact you about it. I am wondering if you or any of your co-authors have continued working in this line of research because I think it would fit nicely into an issue of the Medical Research Archives. I will be editing the next few issues of the journal and would be delighted if we could include an article from you.
The parameters of the article would be up to you of course but I was thinking an updated review article might be nice. I am happy to look at any material you have to let you know if it fits our scope. I am also including a link to the journal’s previous issue below so you may get a sense of the kinds of articles we accept. Please let me know if this is a possibility for you.”
I always ignore these requests but this one stood out for the reasons listed above. Thanks for this blog.
Sam
Spamtraps received the same.
We listed mrajournal.org (domain registration dates from 20150516 but it hadn’t been used for this yet) and the Polish ESP Atman.pl’s range 31.186.80.0/22 over this.
Hmm
It looks like it might be time to list all IP ranges announced by AS57367 pre-emptively.
91.185.184.0/22 listed.
for
Received: from server2.mrajournal.org (server2.mrajournal.org [91.185.185.233])Received: from server1.mrajournal.org (server1.mrajournal.org [213.189.52.237])Dum de dum…
213.189.52.0/23 listed.Let’s check again.213.189.32.0/19 listed.
What happened to Lisset?
This time it’s A. Lesnevskyi…
“Dear Dr. xxx,
An article you authored caught my attention and I am hoping to discuss with you publishing a followup to it, or even a review article in an upcoming issue of the Internal Medicine Review. The article was titled “xxx”. I think a new article in this area would be valuable and it would be great if you would consider preparing something. Please let me know if it is okay for me to send along more information about our journal.
Would you or maybe one of your students possibly have time to contribute an article this year?
Best Regards,
A. Lesnevskyi, M.D.
Senior Editor
Internal Medicine Review”
How long will they continue to be interested in my article….
Yeah, Dr A Lesnevskyi MD appears in the traps too.
Received: from server5.imrjournal.net (server5.imrjournal.net [77.79.227.179])Let’s see… Domain registered April 2016 with Go Daddy, not listed yet. Fixed.
And what about the IP address?
Now all listed.
This in only two days ago.
You wouldn’t guess where the resources are hosted.
Yeap, Atman has their work cut out for them. This domain and its pal
copernicuspublishing.comwere only registered in mid-February 2018.Meanwhile, the spamming IPs are in a Chilean network owned by Latvians in Great Britain, also known as AS61440 HOST1PLUS. Listed the /23, prepared to list more. Looked at the reverse DNS too – it is possible that the Fazel spammers are the most legitimate customers of this network, everything else stinks to high heaven of affiliate spam. But that’s not in scope for us.
ATMAN threw them out. Finally. ATMAN networks are no longer listed.
31.186.80.0/22, 77.79.192.0/18, 91.185.184.0/22, 128.204.218.0/21, 212.91.26.0/23 and 213.189.32.0/19 were removed from the list today, May 10.
Fazel are still spamming from the AS61440 network that they started using two months ago, and mostly hosting on CloudFlare now.
I received this email in 24 Jun:
“Dear Dr. x,
I wanted to get in touch with you about the idea of preparing an article that is related to the article you published some time ago titled “xxxxx”. I serve on the board of the Medical Research Archives and would be happy to work with you to get such an article published this year. Please let me know if this is of interest to you and I will send along all of the details.
Sincerely,
Dr. Kateryna Bielka, M.D.
Editorial Board
Medical Research Archives
ISSN: 2375-1924″
And she keeps insisting on it:
“Dear Dr xxx,
Please reply to my previous email when you get a chance. I am happy to answer any quesitons you may have.
Sincerely
Dr. Kateryna Bielka, M.D.”
So annoying!!
Spamming from Amazon SES now, several new domains listed.