The Doctors or Everyday Health & Wellness or Women's Health
You may also see this as a redirection to "SavetheChildren.org" but that is a clever trick to make you think they are legitimate.
This scam has been exposed at many different locations on the Internet.
It has appeared as a Caralluma weight-loss scam, a Forskolin Fuel weight-loss scam, as a Safflower Oil weight-loss scam, and Garcinia fraud, varying by date and even by geography. The same claims were made, using identical before-and-after pictures for different scams.
Safflower Oil exposed as a scam
- Refutes Safflower claims Senior editor, FoodNavigator-USA, NutraIngredients-USA, FeedNavigator: Stephen Daniells (Chicago)
- Report advises against it Article written by Russell H. Greenfield, MD. Clinical Assistant Professor of MedicineUNC Chapel Hill School of Medicine.
- Inboxrevenge description of Caralluma and Safflower oil scams
- Here Are 7 'Miracle' Products Dr. Oz Had Peddled Huffington Post, The Huffington Post | By Catherine Taibi. Posted: 04/23/2015 3:35 pm EDT Updated: 04/27/2015 10:59 am EDT
Analysis[]
Relentlessly spammed in the April - November 2015 time-frame, "The Doctors" tries to avoid blacklisting by anti-spam tools and reputation services (such as MyWot and McAfee SiteAdvisor).
Basic summary[]
"The Doctors" (EveryDay Health & Wellness) is a highly spammed operation promoting what claims to be a weight-loss product.
It sells one product: either Caralluma or CLA Safflower oil or Forskolin Fuel or Garcinia. The Wikipedia entry does not agree with the claims on Safflower oil - Wkipedia on Safflower
Sample spam[]
<a href="http://bnoshop.com/might.php"><a href="http://bnoshop.com/might.php" target="_blank">http://bnoshop.com/might.php</a></a> <br><br><br>Michael Wilson<br><a href="https://yho.com/footer0">Sent from Yahoo Mail for iPhone</a><br>
Analysis of the spam[]
The last line has a link to a compromised web site:
bnoshop.com/might.php
The compromised web site is bnoshop.com which has had a new file added, might.php.
This web page contains a redirection to another server. This server in turn performs another redirection, to a web site like
http://404-health.eecim.com/enkogc/everyday/r-cla-safflower-oil/ or http://160-healthandbeauty.brfvy.com/engdmk/everyday/we-pure-natural-forskolin/
So in these examples the actual web site containing the weight loss scam resides on the domain eecim.com or brfvy.com
How they hide[]
A more recent example: If you load atezt.com you will see the Save The Children.org page. But if you load http://413-healthandbeauty.atezt.com/enbsmd/everyday/we-pure-natural-forskolin/ you will see EveryDay Health & Wellness - the Forskolin scam.
Fake: Use of references[]
False Dr Oz claim[]
The claim "As Advertised On:" implies that the product was reported on by the television shows/stations or websites for which the logos are presented. This is an attempt to lend credibility to the product where none actually exists. The reference to Oprah Winfrey implies her endorsement, but that is a false claim.
Previously the same web sites had an identical format, with the exact same before and after photos and testimonials, but for another weight-loss scam - Caralluma. When this was revealed as a scam, they switched to Safflower Oil, but did not bother to change the images.
Refer to the web site DoctorOz.com to see if it is really recommended for weight loss. http://www.doctoroz.com/article/safflower-oil-use-fat-lose-fat states So, should you go out and start taking safflower oil products for weight loss? The answer, for now, is no. And why not? Because the approach is based primarily on the results of a single small study, a study whose weaknesses are significant.
The claim of "personally recommended by Dr. Mike Moreno ... author of the 17 Day Diet" is nonsense. Furthermore, there is no reference to Safflower Oil in his 17 Day Diet.
Identical claims for different products[]
Misuse of stolen image[]
The before and after image of Kimberly Truesdell, who lost weight using only a change in diet to reduce calories, has been misused and attributed to Kristy, Miami FL.
Technical analysis[]
Generally, the name servers that resolve access to the web site names are registered on the Russian country level. We have detected 300 such name servers, for example
ns1.caosiundre.ru ns2.caosiundre.ru
ns1.cjaoijdsec.ru ns2.cjaoijdsec.ru
ns1.cjnsoiuenrfser.ru ns2.cjnsoiuenrfser.ru
ns1.ckjanosdi.ru ns2.ckjanosdi.ru
The name servers reside on IP addresses located in various European countries.
A name server typically resolves addresses for between 5 and 15 names, which are usually in the format com-XXX.net where XXX comprises a random selection of alphanumeric characters. Later the convention changed to the format XXXXX.net or XXXXXX.net where again the name comprises a random selection of 5 or 6 alphanumeric characters.
Sponsoring Registrars[]
Here is a list of domain names used in this scam, and the registrars who are sponsoring them. Many of the registrations contain false data. That puts the registrar in breach of the ICANN Registrar Accreditation Agreement.
ALPNAMES LIMITED[]
axxsnf.com ehxhm.com kvngp.com msxsse.com nxhcev.com oulhi.com rnkmmc.com vurkcj.com
BIZCN.COM, INC.[]
epu1nt.net icaty5.net nofugb.net vo93dv.net
CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY CO., LTD.[]
akyjpf.com bjcuoy.com cebhy.com ctmvc.com dimucd.com dkvlj.com dlgil.com dzvxh.com ebfgn.com fsbuu.com fteju.com fuixp.com gckrxc.com huymxm.com ihruhj.com jgsyu.com lrmxr.com ngetjd.com ngouub.com npygjr.com pgibvg.com pjinb.com rernrk.com rghce.com splhus.com ufytn.com ujpms.com vkzox.com vlenu.com zglnv.com
ERANET INTERNATIONAL LIMITED[]
abmoi.com grypzp.com iobzau.com
INTERNET DOMAIN SERVICE BS CORP[]
bjopmu.com bkeabc.com ctyzfi.com fovtl.com fsruio.com gnlcej.com hurvb.com ikrfcd.net jbapbp.net lizrp.com mmdag.com ocuygh.com paiznb.com pujzsn.net vafhme.net ycbfbf.com
NAUNET-RU[]
acmaosec.ru adcoeewr.ru adcwewe.ru afkadiwcwe.ru akcmosie.ru akcmsoiec.ru alckosiec.ru ascisecas.ru asidcwes.ru asosiges.ru cabecsec.ru cagceces.ru cagosien.ru caisdcasecs.ru cakosicse.ru canosieca.ru caosieca.ru caosiecs.ru caosiers.ru caosiesece.ru caosigse.ru ccissesas.ru chasfcegp.ru cjnisugsecs.ru ckagisecc.ru ckaogise.ru ckaosige.ru ckjanosdi.ru ckjnaosiu.ru cknaogns.ru ckogssec.ru ckosiecaser.ru ckosiecsr.ru ckosigsc.ru cksginsec.ru cksgnscs.ru cksigscc.ru cksoigse.ru clsgosie.ru cmaosiease.ru cmaosiefc.ru cmgsecasc.ru cmoaidfsraf.ru cmoigsonfc.ru cmosiecas.ru cmosigseirsc.ru cnaisoungs.ru cnaosiue.ru cnasrres.ru cngscsec.ru cnosigese.ru coaigsierfscs.ru cogsecse.ru cosecsecs.ru cosierrc.ru cosises.ru cscsercs.ru csnociase.ru csnoiacse.ru csogiaces.ru dcnoasecs.ru dcosiejacse.ru dkmoiscs.ru dkncoiuj.ru dkoaceace.ru doiccase.ru dvaosecs.ru eacaoigezxe.ru ecosiurcse.ru gacsecse.ru gacsniec.ru gbanoogi.ru hgacsecs.ru ioncsefser.ru kcnoaigs.ru kcoaciecs.ru kcoaicde.ru kcoaigsecs.ru kcoisdec.ru kcoiserc.ru kcosieca.ru kgcoases.ru kjcnoasie.ru kloidsecse.ru kmobkiaicsea.ru kncoijnsec.ru knmociser.ru knmocisgse.ru knvseoec.ru lcasecse.ru lkgnosnce.ru mcasecas.ru mcoisece.ru mscseoas.ru ncasiecs.ru ndosigec.ru nsocecsc.ru ocisaercase.ru pcoixgeser.ru pkoincusn.ru rckniersdr.ru skcmosie.ru smosiecse.ru sngosiiec.ru tacnusieca.ru tcosigsers.ru tgngasec.ru uscnoisuec.ru ybncsiuecs.ru
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM[]
axxxmb.com czvxny.com dejcn.com ftroox.com upjgg.com
R01-RU[]
cnasoijn.ru cnedrsec.ru coancac.ru coasiescs.ru cswdrecs.ru doingsec.ru dradfacs.ru iecwsese.ru ncefrdcs.ru ngsocs.ru oajngsc.ru ockangs.ru qswcnw.ru sduuwcisag.ru
TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM[]
ecdkvt.com eecim.com fadlc.com gicue.com gzonb.com iayke.com jhjrdp.com ogfkb.com
Suspended by the registrars[]
35 TECHNOLOGY CO., LTD[]
com-afp.net (suspended) com-c4i.net (suspended) com-o2f.net (suspended)
BIZCN.COM, INC.[]
com-083.net (suspended) com-its.net (suspended) com-x7y.net (suspended) com-zc2.net (suspended) 0gbdn1.net (suspended) 4pxpo0.net (suspended) gt9dg7.net (suspended) ltfdep.net (suspended) rxu3go.net (suspended) u8kvn2.net (suspended) z3jdra.net (suspended)
CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY[]
com-in8.net (suspended) com-l4i.net (suspended) com-lt5.net (suspended) com-z1d.net (suspended)
FOSHAN YIDONG NETWORK CO. LTD[]
1m11hp.net (suspended) 2x768k.net (suspended) 4epgv0.net (suspended) 8lxpvk.net (suspended) aooeak.net (suspended) jbp4ec.net (suspended) u3nx2t.net (suspended) vozcbt.net (suspended)
HICHINA ZHICHENG TECHNOLOGY LTD.[]
com-05p.net (suspended) com-0z7.net (suspended) com-2sf.net (suspended) com-52h.net (suspended) com-b5g.net (suspended) com-bng.net (suspended) com-dif.net (suspended) com-ekt.net (suspended) com-ftf.net (suspended) com-hbr.net (suspended) com-hsx.net (suspended) com-k11.net (suspended) com-m4c.net (suspended) com-mnz.net (suspended) com-nfd.net (suspended) com-oyf.net (suspended) com-tng.net (suspended) com-y92.net (suspended) com-yzl.net (suspended) com-z3o.net (suspended) 3gdnx1.net (suspended) 6j7y93.net (suspended) 7s8llc.net (suspended) 8cn2pg.net (suspended) 9bnusb.net (suspended) 9uy0mc.net (suspended) a4jlod.net (suspended) aiv7dt.net (suspended) cnk3yt.net (suspended) cs2s1m.net (suspended) d9jyzn.net (suspended) e7on3p.net (suspended) fhclr3.net (suspended) hol87h.net (suspended) hsy8i6.net (suspended) jfty4j.net (suspended) mm3xzx.net (suspended) o11lco.net (suspended) uz9ybo.net (suspended) v3hxi3.net (suspended) vbbdyy.net (suspended) x7rl0s.net (suspended)
SHANGHAI MEICHENG TECHNOLOGY[]
com-8tm.net (suspended) com-b89.net (suspended) com-inl.net (suspended) com-t53.net (suspended) ihlts9.net (suspended)
NAMESILO, LLC[]
com-5hr.net (suspended) com-6e3.net (suspended) com-0vh.net (suspended) com-8fv.net (suspended) com-01m.net (suspended) com-10q.net (suspended) com-14m.net (suspended) com-30n.net (suspended) com-622.net (suspended) com-862.net (suspended) com-8v0.net (suspended) com-e6d.net (suspended) com-f0p.net (suspended) com-hgt.net (suspended)
R01-RU[]
acdecs.ru acnokjige.ru aiojkn.ru ajcniosjec.ru ajncoisu.ru akmcme.ru aoixddse.ru aosindf.ru asgang.ru asgaung.ru asingec.ru awscsag.ru cdoacdgf.ru cjdmvf.ru cjeniosge.ru cjneoasid.ru cjnsoij.ru ckaoidcse.ru cloasuisf.ru cnaosi.ru cnaosicse.ru cniajngse.ru cnoisuje.ru cnoking.ru cnoseoc.ru cnosknge.ru coadie.ru coidacs.ru coiedcs.ru coieddcs.ru coinsecse.ru coixsdcs.ru cosincecws.ru cosknge.ru csoecos.ru dafvjnoisj.ru dageswfs.ru dcajnoisj.ru dcnisecsf.ru deknciu.ru dfcoesc.ru dfjoaic.ru dfodeace.ru dfokqscse.ru dfokxscse.ru dfoxdace.ru dginaodce.ru dkoace.ru dkoaice.ru dkocase.ru dkocoase.ru dkoiaces.ru dnedisecs.ru dnixsecs.ru doasige.ru doicsec.ru doqrfiecs.ru dorfxiecs.ru dsocoec.ru edisdcs.ru edoxdcwe.ru edtgfjoaic.ru efgang.ru eingsse.ru fgsncoe.ru fgysec.ru fvjcnoijs.ru gacdsecse.ru gaedsecs.ru gaseczfs.ru gaxsecs.ru gbcjnisju.ru ggdescse.ru ghuecs.ru gssfwcsef.ru hancoieuc.ru hgolsgs.ru hgwseqgs.ru hinoces.ru hnjiecs.ru hnkfnoide.ru hnkoincse.ru hodace.ru iaonocs.ru ihgdsdeq.ru ihgdxsde.ru itounde.ru iutsbec.ru jctnoiu.ru jisecser.ru jkijgnse.ru jksnoics.ru jmjndijcse.ru jnijgse.ru jniocjusc.ru jnitjgse.ru jnoiuse.ru jrnsoij.ru jsiescs.ru jymjcae.ru kchrtone.ru kcmoigses.ru kdaeoncs.ru kdcoaec.ru kdefoas.ru kdfoas.ru kdoaceac.ru kdoacs.ru kdoiacs.ru kesoin.ru kfoicecse.ru kjcnoiu.ru kmocsg.ru kncoai.ru kncosec.ru knmcokg.ru kockjinsoe.ru koekjins.ru kotdvce.ru ktsnoics.ru kwyedec.ru lmoads.ru loaedsuis.ru loasxuis.ru mdoiase.ru mjbctae.ru mjoeads.ru mnocsec.ru ncoisjncs.ru ncoiuss.ru ncosiecs.ru ncoyges.ru nedotgec.ru nitjgse.ru nsdozfec.ru nseddoec.ru ntmgos.ru nycoaic.ru oaswncb.ru oavtsnc.ru ocjnaouis.ru oginscsse.ru oindsecer.ru oiounde.ru oitounde.ru osdribs.ru osrrdud.ru paubgise.ru pedhgsgs.ru phcgsgs.ru phgsxgs.ru pzhgsgs.ru qaacjnios.ru rcnoiu.ru rjdmvf.ru roioace.ru salkcew.ru scmoise.ru scniosund.ru sduwcisag.ru sduxcisag.ru sedcsag.ru sedxidcd.ru sekodce.ru sescisag.ru sgaxwng.ru sgeang.ru sgseoin.ru sgsxsoin.ru shgxdesc.ru sinwscs.ru skjnyhcons.ru snmgos.ru snofds.ru snqoiqgdc.ru sntmgos.ru socodcs.ru soicsgfis.ru soiedsgfis.ru soigsddc.ru soisgfais.ru soisxgfis.ru ssfsoinoi.ru sxkjncons.ru tkntedcoai.ru ucsiocs.ru ucsops.ru uigsecs.ru uncisuge.ru usediocs.ru usedops.ru usopas.ru usxiocs.ru utgdedoacs.ru wafspce.ru wafspuce.ru wdtgiibuec.ru wednoges.ru wfsncoisec.ru wfspece.ru wgecsec.ru wkoace.ru wnfoisdcs.ru wnsoij.ru wnxoges.ru wsarfoncs.ru wsexidcd.ru wsncoisec.ru wswdidcd.ru xdewlea.ru yncadizfc.ru yncuiosue.ru ynedcadic.ru ynxcadic.ru zfspce.ru zusiocs.ru
This operation would not be possible without the support of the registrars who provide services to the site owner.
How to complain[]
Send a request to the registrar or ISP via email.
Sources for this article[]
CLA Safflower oil scam
- http://en.wikipedia.org/wiki/Safflower
- http://www.doctoroz.com/article/safflower-oil-use-fat-lose-fat
- http://www.nutraingredients-usa.com/Research/CLA-community-hits-back-at-safflower-oil-claims-Science-wise-safflower-oil-is-not-a-serious-alternative-to-CLA-for-improved-body-composition
Caralluma scam
- Arora E, Khajuria V, Tandon VR, Sharma A, Mahajan A, Gillani ZH, Choudhary N. To evaluate efficacy and safety of Caralluma fimbriata in overweight and obese patients: A randomized, single blinded, placebo control trial. Perspect Clin Res [serial online] 2015 [cited 2015 Apr 21];6:39-44. Available from: http://www.picronline.org/text.asp?2015/6/1/39/148812