Internal Medicine Review, Dylan Fazel, Reni Koen, “Lisseth Tovar”, “Kateryna Bielka”, ke-i.org, internalmedicinereview.org, zel.li

This is really just a pointer to a blog article published elsewhere on the topic of an annoying Swiss spammer apparently based in Latin America.

Apparent senders:

$ grep '^From:' Mail/scientificspam.ke-i | sort | uniq
From: D Fazel <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Koen, Reni" <[email protected]>
From: "Mihaleva, Milena" <[email protected]>

Related Scientific Spam listings:

$ check 179.43.141.109
179.43.141.109 A 127.0.0.2 TXT "[FAZEL] Followup Article [email protected] 20160430"

$ check 179.43.141.96
179.43.141.96 A 127.0.0.2 TXT "[FAZEL] /27 escalation - Dylan Fazel / ke-i.org / internalmedicinereview.org / zel.li [email protected] 20160430"

$ check 179.43.141.6
179.43.141.6 A 127.0.0.2 TXT "[FAZEL] /24 escalation - Dylan Fazel - see https://scholarlyoa.com/2016/08/04/about-those-manipulative-spam-emails-from-internal-medicine-review/ for discussion [email protected] 20160906"

$ check internalmedicinereview.org ke-i.org zel.li
internalmedicinereview.org A 127.0.1.2 TXT "[FAZEL] Followup Article [email protected] 20160430"
ke-i.org A 127.0.1.2 TXT "[FAZEL] Re: Manuscript Submission [MRA] [email protected] 20150526"
zel.li A 127.0.1.2 TXT "[FAZEL] Followup Article [email protected] 20160430"

IP WHOIS:

[whois.lacnic.net]

inetnum:     179.43.141.96/27
status:      reallocated
owner:       Private Layer Switzerland
ownerid:     CH-PLSW-LACNIC
responsible: Ezequiel Pineda
address:     Ocean Business Plaza, Piso 17 Suite 1703, , 
address:     00000 - Zurich - CH
country:     CH
phone:       +507  8365601 [32]
owner-c:     TSD2
tech-c:      TSD2
abuse-c:     TSD2
created:     20131218
changed:     20131218
inetnum-up:  179.43.128/18

Domain WHOIS:

[whois.nic.li]
whois: This information is subject to an Acceptable Use Policy.
See https://www.nic.ch/terms/aup/


Domain name:
zel.li

Holder of domain name:
Dylan FAZEL
340 S Lemon Ave 7750
US-91789 Walnut
United States
Contractual Language: French

Technical contact:
FAZEL Dylan
340 S Lemon Ave 7750
US-91789 WALNUT
United States

Registrar:
NETIM

First registration date:
2008-09-19

DNSSEC:N

Name servers:
ns1.zel.li      [179.43.141.109]

23 thoughts on “Internal Medicine Review, Dylan Fazel, Reni Koen, “Lisseth Tovar”, “Kateryna Bielka”, ke-i.org, internalmedicinereview.org, zel.li

  1. RocketScientist Post author

    Lisseth hangs / was hanging out in Morocco at the time she made a dishonest delisting request to Sci Spam.

    From [email protected]  Tue Aug  2 08:01:39 2016         
    Received: from server.zel.li (server.zel.li [179.43.141.109])                   
            (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))             
            (No client certificate requested)                                       
            by homiemail-mx5.g.dreamhost.com (Postfix) with ESMTPS id B26B215627E   
            for <[email protected]>; Tue,  2 Aug 2016 01:01:38   
            -0700 (PDT)                                                             
    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;                
            d=internalmedicinereview.org; s=default;                                
            h=Content-Type:MIME-Version:Subject:                                    
            Message-ID:To:From:Date:Sender:Reply-To:Cc:Content-Transfer-Encoding:   
            Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:   
            Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:   
            List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;                                                                           
            bh=qISH+8mtZ66Dw248r6oPuln8KK+Pn9Y1YMT//zLU3Ng=;                        
            b=updeUjPalHn39BRa/KVfRGWx9m4fdX60QOZqu50wN/iAgg2MznoDSq+4dCr6EzziYfNvkHP4QDa5pDo3uI52h1Wwxu/wgTs6afqvYw4YV2uisiPF7U3YPql7FE/QNzB4vQwiDvlIL290agzdil1XwNU2gAkHQtEcWJDDHUOuf7fm4Dcj38TPwGYeUJimhsz/gMtwaKrBSBLT1KT600N0pe6TRXG/OpAlDYozRCv91otKfC8hTgRlVgHpOdRotIhXyV5Wc7jiXOFJvGsCInwrvYmCJlKEkT+DviwLyHMO0iO2794/mmPVW2jXBlgVh8cKWz6168leYX5GTNZ1OGKTyQ==;
    Received: from adsl196-10-240-217-196.adsl196-16.iam.net.ma
            ([196.217.240.10]:62463 helo=Macs-MacBook-Air.local)
            by server.zel.li with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
            (Exim 4.87)
            (envelope-from <[email protected]>)
            id 1bUUgw-0003fE-3w
            for [email protected]; Tue, 02 Aug 2016 12:04:48
            +0400
    Date: Tue, 2 Aug 2016 09:01:31 +0100
    From: "Dr. Lisseth Tovar M.D." <[email protected]>
    To: [email protected]
    Message-ID: <[email protected]>
    Subject: IP removal request
    X-Mailer: Airmail (351)
    MIME-Version: 1.0
    Content-Type: multipart/alternative; boundary="57a0535b_154abb0_3cc6"
    X-AntiAbuse: This header was added to track abuse, please include it with any
            abuse report
    X-AntiAbuse: Primary Hostname - server.zel.li
    X-AntiAbuse: Original Domain - scientificspam.net
    X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
    X-AntiAbuse: Sender Address Domain - internalmedicinereview.org
    X-Get-Message-Sender-Via: server.zel.li: authenticated_id:
            [email protected]
    X-Authenticated-Sender: server.zel.li: [email protected]
    Status: RO
    X-Status: A
    Content-Length: 2478
    Lines: 48
    
    Hello, we are requesting that you please remove IP 179.43.141.109 from your list. We were sending some non-commercial cold emails to some physicians and researchers who have journal articles on PubMed that are of interest to editors of our medical journals. We have since cleaned our lists. Please let me know if you would like additional information.
    
    Thank you,
    
    Lisseth Tovar
    Internal Medicine Review
    

    Our prompt response:

    We acknowledge the receipt of your request.

    Your request is denied at this time. In the absence of spam for half a year, you can try again. The quarantine period is counted from 1 July 2016, so please write again in the new year.

    Of course, the spam keeps coming in, both to unmanned spamtraps we monitor as well as those of actual live scientists reporting in the thread on Dr Beall’s blog.

    Reply
  2. Smut Clyde

    Thanks for the link to Riddled!
    Lisseth has spammed me repeatedly in the last few weeks, but it’s the same old bullsh1t story in which she lies about following up previous correspondence. Time for a new script, people!

    Reply
    1. RocketScientist Post author

      You’re welcome. Thank *you*.

      Yes, our spamtraps are witnessing the same, and over on Beall’s blog, more and more people are coming forward with reports of the same.

      Reply
  3. RocketScientist Post author

    Received: from server.zel.li (server.zel.li [77.79.248.75])

    % Abuse contact for '77.79.248.0 - 77.79.248.255' is '[email protected]'
    
    inetnum:        77.79.248.0 - 77.79.248.255
    netname:        ATMAN-ECO-Servers
    descr:          ATMAN Network ECO-Servers
    remarks:
    remarks:        abuse and spam problems please report to: [email protected]
    

    …to no effect whatsoever, so listed in its entirety.

    Reply
  4. MMM

    Yup. I was pretty disgusted by the blatant lie (“We talked some months ago…”). Without that, this would just be run of the mill spam.

    -MMM

    1/16/17
    Dear Dr. XXX,

    I wish you a happy new year. We talked some months ago about the idea of publishing a followup article to the one you authored entitled “XXX.”. Is now a better time for you to write something? Is there anything I can do to help? If now isn’t the right time for you to work on a followup to this article, I would certainly be interested in knowing more about your current research.

    I will tell you more about the journal in case you don’t still have our earlier emails. The Internal Medicine Review is a hybrid journal with optional open access. The issues are monthly, and published both online and in print. The submission deadline is flexible.

    Please get back to me at your earliest convenience.

    Sincerely,

    Dr. Lisseth Tovar
    Senior Editor
    Internal Medicine Review (IMR)

    Reply
    1. Ricky

      Yep, I just got that one today. Exact same email with my name and my journal article in the XXX spaces. It’ about the 5th email I’ve received from them.

      Reply
    1. RocketScientist Post author

      So have our spamtraps. Yeah, no sign of the operation stopping.

      As with most of our “target group,” the spam volume is so low, and the targeting so good (yeah, not really that fantastic, but “scientists of any sort,” rather than “anything with an email address”) that the generic spam blocklists will never notice these folks; using the ScientificSpam DNSBLs on a mail server may be the only scalable manner of allowing email recipients not to receive such email at all.

      Reply
  5. Benoit

    I got the same e-mail today and I have received three of four other bogus e-mails from her before.
    She keeps changing her e-mail address so that she gets through my Blocked Sender list.

    Reply
    1. RocketScientist Post author

      Perhaps you could mention our existence to your mail admins – your site is one of the lucky few who haven’t outsourced to Office 365, or Google, yet.

      Reply
  6. Rosaleen McCarthy

    Have been spammed as well asking whether I was “still interested” in preparing a manuscript for Internal Medicine. Not sure whether to reply and say “not relevant for a psychologist” or just to ignore and wait for it /her/them to go away.

    Reply
    1. RocketScientist Post author

      We recommend neither. Replies to spam confirm your address is live and a good target for more spam. They are also not going to go away. What you can do is to talk to the email administrators of your university/institute and ask them to prevent the reception of email from this spammer to you and all others.

      They can either do it on their own – or they would be most welcome to configure their systems to consult our free services. Both of the entities involved in your case operate their own, so they are still holding the reins (unlike other similar entities who have e.g. outsourced to Microsoft or Google).

      We would be delighted to discuss with them; please let them know rocket dot scientists at scientificspam dot net will gladly answer any question they might have regarding the use of our services.

      Reply
  7. Lhac

    She keeps it coming…:

    “Dear Dr. xxxx,

    I realized that our system and process may not be that easy-to-understand. Hence, I am happy to assist you in all the ongoing processes during submission, peer-reviews and other stages of scientific publication.

    Do you have any questions at this point?

    Sincerely,

    Dr. Lisseth Tovar
    Senior Editor
    Internal Medicine Review (IMR)
    http://www.internalmedicinereview.org

    Reply
  8. Elizabeth Steele

    Spam solicitation received today – wants to know if I’ll write a f/u to an article published last year.

    Reply
  9. Philip C Rosen

    I got more of the same spam today. Since my research and the specific article they requested f/u on are completely unrelated to the journal title being touted (Internal Medicine Review), I presume the operation is running a bot that clips author names, email addresses, and titles and inserts them into email and text for mass distribution.

    Unlike most phishing efforts, this is written in perfect English and might be dangerous to the unwary.

    Reply
    1. RocketScientist Post author

      We think you’re right with respect to the targeting policies of the Dylan Fazel operation.

      It’s not phishing as far as we can see, though, just run-of-the-mill Scientific Spam.

      Reply
  10. Ramy

    I got the same spam!

    ###
    July 7, 2017

    Dear Dr. XXX,

    One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “XXXXXX.”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.

    Would you or perhaps one of your students have time to contribute an article over the summer?

    Sincerely,
    Lisseth Tovar, M. D.
    Senior Editor
    Internal Medicine Review
    http://www.internalmedicinereview.org

    Reply
  11. jo

    Dear Dr. MY NAME,

    One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “MY PAPER, 2016”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.

    Would you or perhaps one of your students have time to contribute an article over the summer?

    Sincerely,

    Lisseth Tovar, M. D.

    Senior Editor

    Internal Medicine Review

    http://www.internalmedicinereview.org

    This email and attachments sent with it are confidential and intended only for the use by the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not read, distribute or copy this e-mail. Please notify the sender immediately by e-mail or at 712 H Street Suite 1018 Washington DC 20002 USA. If you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *