Internal Medicine Review, Dylan Fazel, Reni Koen, “Lisseth Tovar”, “Kateryna Bielka”, ke-i.org, internalmedicinereview.org, zel.li

This is really just a pointer to a blog article published elsewhere on the topic of an annoying Swiss spammer apparently based in Latin America.

Apparent senders:

$ grep '^From:' Mail/scientificspam.ke-i | sort | uniq
From: D Fazel <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Kateryna Bielka, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Dr. Lisseth Tovar, M.D." <[email protected]>
From: "Koen, Reni" <[email protected]>
From: "Mihaleva, Milena" <[email protected]>

Related Scientific Spam listings:

$ check 179.43.141.109
179.43.141.109 A 127.0.0.2 TXT "[FAZEL] Followup Article [email protected] 20160430"

$ check 179.43.141.96
179.43.141.96 A 127.0.0.2 TXT "[FAZEL] /27 escalation - Dylan Fazel / ke-i.org / internalmedicinereview.org / zel.li [email protected] 20160430"

$ check 179.43.141.6
179.43.141.6 A 127.0.0.2 TXT "[FAZEL] /24 escalation - Dylan Fazel - see https://scholarlyoa.com/2016/08/04/about-those-manipulative-spam-emails-from-internal-medicine-review/ for discussion [email protected] 20160906"

$ check internalmedicinereview.org ke-i.org zel.li
internalmedicinereview.org A 127.0.1.2 TXT "[FAZEL] Followup Article [email protected] 20160430"
ke-i.org A 127.0.1.2 TXT "[FAZEL] Re: Manuscript Submission [MRA] [email protected] 20150526"
zel.li A 127.0.1.2 TXT "[FAZEL] Followup Article [email protected] 20160430"

IP WHOIS:

[whois.lacnic.net]

inetnum:     179.43.141.96/27
status:      reallocated
owner:       Private Layer Switzerland
ownerid:     CH-PLSW-LACNIC
responsible: Ezequiel Pineda
address:     Ocean Business Plaza, Piso 17 Suite 1703, , 
address:     00000 - Zurich - CH
country:     CH
phone:       +507  8365601 [32]
owner-c:     TSD2
tech-c:      TSD2
abuse-c:     TSD2
created:     20131218
changed:     20131218
inetnum-up:  179.43.128/18

Domain WHOIS:

[whois.nic.li]
whois: This information is subject to an Acceptable Use Policy.
See https://www.nic.ch/terms/aup/


Domain name:
zel.li

Holder of domain name:
Dylan FAZEL
340 S Lemon Ave 7750
US-91789 Walnut
United States
Contractual Language: French

Technical contact:
FAZEL Dylan
340 S Lemon Ave 7750
US-91789 WALNUT
United States

Registrar:
NETIM

First registration date:
2008-09-19

DNSSEC:N

Name servers:
ns1.zel.li      [179.43.141.109]

40 thoughts on “Internal Medicine Review, Dylan Fazel, Reni Koen, “Lisseth Tovar”, “Kateryna Bielka”, ke-i.org, internalmedicinereview.org, zel.li

  1. RocketScientist Post author

    Lisseth hangs / was hanging out in Morocco at the time she made a dishonest delisting request to Sci Spam.

    From [email protected]  Tue Aug  2 08:01:39 2016         
    Received: from server.zel.li (server.zel.li [179.43.141.109])                   
            (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))             
            (No client certificate requested)                                       
            by homiemail-mx5.g.dreamhost.com (Postfix) with ESMTPS id B26B215627E   
            for <[email protected]>; Tue,  2 Aug 2016 01:01:38   
            -0700 (PDT)                                                             
    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;                
            d=internalmedicinereview.org; s=default;                                
            h=Content-Type:MIME-Version:Subject:                                    
            Message-ID:To:From:Date:Sender:Reply-To:Cc:Content-Transfer-Encoding:   
            Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:   
            Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:   
            List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;                                                                           
            bh=qISH+8mtZ66Dw248r6oPuln8KK+Pn9Y1YMT//zLU3Ng=;                        
            b=updeUjPalHn39BRa/KVfRGWx9m4fdX60QOZqu50wN/iAgg2MznoDSq+4dCr6EzziYfNvkHP4QDa5pDo3uI52h1Wwxu/wgTs6afqvYw4YV2uisiPF7U3YPql7FE/QNzB4vQwiDvlIL290agzdil1XwNU2gAkHQtEcWJDDHUOuf7fm4Dcj38TPwGYeUJimhsz/gMtwaKrBSBLT1KT600N0pe6TRXG/OpAlDYozRCv91otKfC8hTgRlVgHpOdRotIhXyV5Wc7jiXOFJvGsCInwrvYmCJlKEkT+DviwLyHMO0iO2794/mmPVW2jXBlgVh8cKWz6168leYX5GTNZ1OGKTyQ==;
    Received: from adsl196-10-240-217-196.adsl196-16.iam.net.ma
            ([196.217.240.10]:62463 helo=Macs-MacBook-Air.local)
            by server.zel.li with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
            (Exim 4.87)
            (envelope-from <[email protected]>)
            id 1bUUgw-0003fE-3w
            for [email protected]; Tue, 02 Aug 2016 12:04:48
            +0400
    Date: Tue, 2 Aug 2016 09:01:31 +0100
    From: "Dr. Lisseth Tovar M.D." <[email protected]>
    To: [email protected]
    Message-ID: <[email protected]>
    Subject: IP removal request
    X-Mailer: Airmail (351)
    MIME-Version: 1.0
    Content-Type: multipart/alternative; boundary="57a0535b_154abb0_3cc6"
    X-AntiAbuse: This header was added to track abuse, please include it with any
            abuse report
    X-AntiAbuse: Primary Hostname - server.zel.li
    X-AntiAbuse: Original Domain - scientificspam.net
    X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
    X-AntiAbuse: Sender Address Domain - internalmedicinereview.org
    X-Get-Message-Sender-Via: server.zel.li: authenticated_id:
            [email protected]
    X-Authenticated-Sender: server.zel.li: [email protected]
    Status: RO
    X-Status: A
    Content-Length: 2478
    Lines: 48
    
    Hello, we are requesting that you please remove IP 179.43.141.109 from your list. We were sending some non-commercial cold emails to some physicians and researchers who have journal articles on PubMed that are of interest to editors of our medical journals. We have since cleaned our lists. Please let me know if you would like additional information.
    
    Thank you,
    
    Lisseth Tovar
    Internal Medicine Review
    

    Our prompt response:

    We acknowledge the receipt of your request.

    Your request is denied at this time. In the absence of spam for half a year, you can try again. The quarantine period is counted from 1 July 2016, so please write again in the new year.

    Of course, the spam keeps coming in, both to unmanned spamtraps we monitor as well as those of actual live scientists reporting in the thread on Dr Beall’s blog.

    Reply
  2. Smut Clyde

    Thanks for the link to Riddled!
    Lisseth has spammed me repeatedly in the last few weeks, but it’s the same old bullsh1t story in which she lies about following up previous correspondence. Time for a new script, people!

    Reply
    1. RocketScientist Post author

      You’re welcome. Thank *you*.

      Yes, our spamtraps are witnessing the same, and over on Beall’s blog, more and more people are coming forward with reports of the same.

      Reply
  3. RocketScientist Post author

    Received: from server.zel.li (server.zel.li [77.79.248.75])

    % Abuse contact for '77.79.248.0 - 77.79.248.255' is '[email protected]'
    
    inetnum:        77.79.248.0 - 77.79.248.255
    netname:        ATMAN-ECO-Servers
    descr:          ATMAN Network ECO-Servers
    remarks:
    remarks:        abuse and spam problems please report to: [email protected]
    

    …to no effect whatsoever, so listed in its entirety.

    Reply
  4. MMM

    Yup. I was pretty disgusted by the blatant lie (“We talked some months ago…”). Without that, this would just be run of the mill spam.

    -MMM

    1/16/17
    Dear Dr. XXX,

    I wish you a happy new year. We talked some months ago about the idea of publishing a followup article to the one you authored entitled “XXX.”. Is now a better time for you to write something? Is there anything I can do to help? If now isn’t the right time for you to work on a followup to this article, I would certainly be interested in knowing more about your current research.

    I will tell you more about the journal in case you don’t still have our earlier emails. The Internal Medicine Review is a hybrid journal with optional open access. The issues are monthly, and published both online and in print. The submission deadline is flexible.

    Please get back to me at your earliest convenience.

    Sincerely,

    Dr. Lisseth Tovar
    Senior Editor
    Internal Medicine Review (IMR)

    Reply
    1. Ricky

      Yep, I just got that one today. Exact same email with my name and my journal article in the XXX spaces. It’ about the 5th email I’ve received from them.

      Reply
    1. RocketScientist Post author

      So have our spamtraps. Yeah, no sign of the operation stopping.

      As with most of our “target group,” the spam volume is so low, and the targeting so good (yeah, not really that fantastic, but “scientists of any sort,” rather than “anything with an email address”) that the generic spam blocklists will never notice these folks; using the ScientificSpam DNSBLs on a mail server may be the only scalable manner of allowing email recipients not to receive such email at all.

      Reply
  5. Benoit

    I got the same e-mail today and I have received three of four other bogus e-mails from her before.
    She keeps changing her e-mail address so that she gets through my Blocked Sender list.

    Reply
    1. RocketScientist Post author

      Perhaps you could mention our existence to your mail admins – your site is one of the lucky few who haven’t outsourced to Office 365, or Google, yet.

      Reply
  6. Rosaleen McCarthy

    Have been spammed as well asking whether I was “still interested” in preparing a manuscript for Internal Medicine. Not sure whether to reply and say “not relevant for a psychologist” or just to ignore and wait for it /her/them to go away.

    Reply
    1. RocketScientist Post author

      We recommend neither. Replies to spam confirm your address is live and a good target for more spam. They are also not going to go away. What you can do is to talk to the email administrators of your university/institute and ask them to prevent the reception of email from this spammer to you and all others.

      They can either do it on their own – or they would be most welcome to configure their systems to consult our free services. Both of the entities involved in your case operate their own, so they are still holding the reins (unlike other similar entities who have e.g. outsourced to Microsoft or Google).

      We would be delighted to discuss with them; please let them know rocket dot scientists at scientificspam dot net will gladly answer any question they might have regarding the use of our services.

      Reply
  7. Lhac

    She keeps it coming…:

    “Dear Dr. xxxx,

    I realized that our system and process may not be that easy-to-understand. Hence, I am happy to assist you in all the ongoing processes during submission, peer-reviews and other stages of scientific publication.

    Do you have any questions at this point?

    Sincerely,

    Dr. Lisseth Tovar
    Senior Editor
    Internal Medicine Review (IMR)
    http://www.internalmedicinereview.org

    Reply
  8. Elizabeth Steele

    Spam solicitation received today – wants to know if I’ll write a f/u to an article published last year.

    Reply
  9. Philip C Rosen

    I got more of the same spam today. Since my research and the specific article they requested f/u on are completely unrelated to the journal title being touted (Internal Medicine Review), I presume the operation is running a bot that clips author names, email addresses, and titles and inserts them into email and text for mass distribution.

    Unlike most phishing efforts, this is written in perfect English and might be dangerous to the unwary.

    Reply
    1. RocketScientist Post author

      We think you’re right with respect to the targeting policies of the Dylan Fazel operation.

      It’s not phishing as far as we can see, though, just run-of-the-mill Scientific Spam.

      Reply
  10. Ramy

    I got the same spam!

    ###
    July 7, 2017

    Dear Dr. XXX,

    One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “XXXXXX.”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.

    Would you or perhaps one of your students have time to contribute an article over the summer?

    Sincerely,
    Lisseth Tovar, M. D.
    Senior Editor
    Internal Medicine Review
    http://www.internalmedicinereview.org

    Reply
  11. jo

    Dear Dr. MY NAME,

    One of the articles you authored a while ago caught my attention and I am hoping to discuss with you publishing a followup article, or even a review article in the Internal Medicine Review. The article was entitled “MY PAPER, 2016”. I am sure our readers would find an article that continues this work valuable. The parameters of the article are flexible and I am happy to help in any way I can.

    Would you or perhaps one of your students have time to contribute an article over the summer?

    Sincerely,

    Lisseth Tovar, M. D.

    Senior Editor

    Internal Medicine Review

    http://www.internalmedicinereview.org

    This email and attachments sent with it are confidential and intended only for the use by the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not read, distribute or copy this e-mail. Please notify the sender immediately by e-mail or at 712 H Street Suite 1018 Washington DC 20002 USA. If you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

    Reply
  12. paulineddra

    I’ve recieved the same solicitation from Dr. Katryna Bielka and was about to spend significant time putting together a manuscript – am I to understand this is bullshit?? I even filled in an online form with the title, authors, and abstract for my article, and entered an agreed-upon reduced publication fee (that she very easily reduced by 60% as I am a new postdoc and have no extra funding). I didn’t supply any credit card info, but I just want to know if this is a waste of time before spending valuable hours composing a manuscript for nothing… here is a copy of some of her emails:

    Dear Dr. Dr. XX [notice the double Dr…. way to fill in your generic email properly…],

    I hope you are enjoying the start of the new year. We were in contact a few months ago about your paper entitled “XXXXX.”. I wanted to check-in with you again about the possibility of publishing a followup/update to this paper in one of the next issues of the Medical Research Archives. I still think that such an article could be of much interest to our readers and am hoping that you are in a better position to write something now that the new year is starting. The length of the article and timing of submission are flexible. If there is any way I can assist in making this happen please do not hesitate to ask.

    Would you be available to proceed with this in the next 2-3 months?

    Sincerely,

    Dr. Kateryna Bielka, M. D.
    Senior Editor
    Medical Research Archives
    http://www.journals.ke-i.org/mra

    What do I do??????

    Reply
      1. RocketScientist Post author

        Form not found!
        Sorry, the form you are looking for no longer exists.

        Thank you, Cognito Forms.

        Reply
    1. RocketScientist Post author

      It is our advice that you ignore these spammers completely. You do whatever you want, but do read up on them. You could for example check out @Neuro_Skeptic on Twitter to have a second opinion…

      Reply
  13. Sam K

    Hello,
    Just received similar spam from Kateryna Bielka, M. D. on behalf of Medical Research Archives. What distinguished this one from others I receive is the largely correct grammar…no real red flags there. Also, it did not lie about previous correspondence…it seemed to be written as a legit request would be Body of message follows:

    “I hope all is well. An article you authored a while back entitled “XXX” caught my interest and I thought I would contact you about it. I am wondering if you or any of your co-authors have continued working in this line of research because I think it would fit nicely into an issue of the Medical Research Archives. I will be editing the next few issues of the journal and would be delighted if we could include an article from you.

    The parameters of the article would be up to you of course but I was thinking an updated review article might be nice. I am happy to look at any material you have to let you know if it fits our scope. I am also including a link to the journal’s previous issue below so you may get a sense of the kinds of articles we accept. Please let me know if this is a possibility for you.”

    I always ignore these requests but this one stood out for the reasons listed above. Thanks for this blog.

    Sam

    Reply
    1. RocketScientist Post author

      Spamtraps received the same.

      We listed mrajournal.org (domain registration dates from 20150516 but it hadn’t been used for this yet) and the Polish ESP Atman.pl’s range 31.186.80.0/22 over this.

      Reply
  14. RocketScientist Post author
    Received: from server3.mrajournal.org (server3.mrajournal.org [212.91.26.70])   
    

    Hmm

    inetnum:        212.91.26.0 - 212.91.27.255
    netname:        ATMAN
    descr:          ATM S.A.
    descr:          ul. Grochowska 21a
    descr:          04-186 Warsaw
    ...
    % Information related to '212.91.26.0/24AS57367'
    
    route:          212.91.26.0/24
    descr:          EcoSerwers
    origin:         AS57367
    mnt-by:         ATMAN-MNT
    

    It looks like it might be time to list all IP ranges announced by AS57367 pre-emptively.

    Reply
  15. RocketScientist Post author

    91.185.184.0/22 listed.

    inetnum:        91.185.184.0 - 91.185.187.255
    netname:        ECO-ATMAN-PL-20131211
    descr:          ECO-ATMAN-PL
    country:        PL
    

    for

    Received: from server2.mrajournal.org (server2.mrajournal.org [91.185.185.233])

    Reply
  16. RocketScientist Post author

    Received: from server1.mrajournal.org (server1.mrajournal.org [213.189.52.237])

    Dum de dum…

    inetnum:        213.189.52.0 - 213.189.53.255
    netname:        ATMAN-ECO
    descr:          ATM S.A.
    descr:          ul. Grochowska 21a
    descr:          04-186 Warsaw
    

    213.189.52.0/23 listed. Let’s check again.

    % Information related to '213.189.32.0/19AS15694'
    
    route:          213.189.32.0/19
    descr:          ATMAN (PL)
    origin:         AS15694
    

    213.189.32.0/19 listed.

    Reply
  17. Lhac

    What happened to Lisset?

    This time it’s A. Lesnevskyi…

    “Dear Dr. xxx,

    An article you authored caught my attention and I am hoping to discuss with you publishing a followup to it, or even a review article in an upcoming issue of the Internal Medicine Review. The article was titled “xxx”. I think a new article in this area would be valuable and it would be great if you would consider preparing something. Please let me know if it is okay for me to send along more information about our journal.

    Would you or maybe one of your students possibly have time to contribute an article this year?

    Best Regards,

    A. Lesnevskyi, M.D.

    Senior Editor

    Internal Medicine Review”

    How long will they continue to be interested in my article….

    Reply
  18. RocketScientist Post author

    Yeah, Dr A Lesnevskyi MD appears in the traps too.
    Received: from server5.imrjournal.net (server5.imrjournal.net [77.79.227.179])

    Let’s see… Domain registered April 2016 with Go Daddy, not listed yet. Fixed.

    And what about the IP address?

    route:          77.79.192.0/18
    descr:          ATMAN (PL)
    origin:         AS15694
    

    Now all listed.

    Reply
  19. RocketScientist Post author

    This in only two days ago.

    Received: from server.copernicus.email (server.copernicus.email [191.101.20.148])
    ...
    From: "A. Oliver, MSci" <[email protected]>
    Reply-To: [email protected]
    Subject: Regarding your article
    List-Unsubscribe: <http://mumara.ke-i.org/Mumara/unsubscribe.php?id=x%3D>
    

    You wouldn’t guess where the resources are hosted.

    $ host mumara.ke-i.org
    mumara.ke-i.org has address 77.79.248.75
    $ host -t ns copernicus.email
    copernicus.email name server ns1.copernicus.email.
    copernicus.email name server ns2.copernicus.email.
    $ host ns1.copernicus.email
    ns1.copernicus.email has address 77.79.250.28
    

    Yeap, Atman has their work cut out for them. This domain and its pal copernicuspublishing.com were only registered in mid-February 2018.

    Meanwhile, the spamming IPs are in a Chilean network owned by Latvians in Great Britain, also known as AS61440 HOST1PLUS. Listed the /23, prepared to list more. Looked at the reverse DNS too – it is possible that the Fazel spammers are the most legitimate customers of this network, everything else stinks to high heaven of affiliate spam. But that’s not in scope for us. 🙂

    Reply
  20. RocketScientist Post author

    ATMAN threw them out. Finally. ATMAN networks are no longer listed.

    31.186.80.0/22, 77.79.192.0/18, 91.185.184.0/22, 128.204.218.0/21, 212.91.26.0/23 and 213.189.32.0/19 were removed from the list today, May 10.

    Fazel are still spamming from the AS61440 network that they started using two months ago, and mostly hosting on CloudFlare now.

    Reply
  21. Lara

    I received this email in 24 Jun:

    “Dear Dr. x,
    I wanted to get in touch with you about the idea of preparing an article that is related to the article you published some time ago titled “xxxxx”. I serve on the board of the Medical Research Archives and would be happy to work with you to get such an article published this year. Please let me know if this is of interest to you and I will send along all of the details.

    Sincerely,
    Dr. Kateryna Bielka, M.D.
    Editorial Board
    Medical Research Archives
    ISSN: 2375-1924″

    And she keeps insisting on it:
    “Dear Dr xxx,
    Please reply to my previous email when you get a chance. I am happy to answer any quesitons you may have.

    Sincerely
    Dr. Kateryna Bielka, M.D.”

    So annoying!!

    Reply

Leave a Reply to RocketScientist Cancel reply

Your email address will not be published. Required fields are marked *