The Doctors

**The Doctors** or **Everyday Health & Wellness** or **Women's Health**

You may also see this as a redirection to "SavetheChildren.org" but that is a clever trick to make you think they are legitimate.

This scam has been exposed at many different locations on the Internet.

It has appeared as a Caralluma weight-loss scam, a Forskolin Fuel weight-loss scam, as a Safflower Oil weight-loss scam, and Garcinia fraud, varying by date and even by geography. The same claims were made, using identical before-and-after pictures for different scams.

Safflower Oil exposed as a scam

* Refutes Safflower claims Senior editor, FoodNavigator-USA, NutraIngredients-USA, FeedNavigator: Stephen Daniells (Chicago)
* Report advises against it Article written by Russell H. Greenfield, MD. Clinical Assistant Professor of MedicineUNC Chapel Hill School of Medicine.
* Inboxrevenge description of Caralluma and Safflower oil scams
* Here Are 7 'Miracle' Products Dr. Oz Had Peddled Huffington Post, The Huffington Post | By Catherine Taibi. Posted: 04/23/2015 3:35 pm EDT Updated: 04/27/2015 10:59 am EDT

# Analysis

Relentlessly spammed in the April - November 2015 time-frame, "The Doctors" tries to avoid blacklisting by anti-spam tools and reputation services (such as MyWot and McAfee SiteAdvisor).

## Basic summary

"The Doctors" (EveryDay Health & Wellness) is a highly spammed operation promoting what claims to be a weight-loss product.

It sells one product: either Caralluma or CLA Safflower oil or Forskolin Fuel or Garcinia. The Wikipedia entry does not agree with the claims on Safflower oil - Wkipedia on Safflower

## Sample spam

```
<a href="http://bnoshop.com/might.php"><a href="http://bnoshop.com/might.php"
       target="_blank">http://bnoshop.com/might.php</a></a>   <br><br><br>Michael
       Wilson<br><a href="https://yho.com/footer0">Sent from Yahoo Mail for iPhone</a><br>

```

### Analysis of the spam

The last line has a link to a compromised web site:

```
bnoshop.com/might.php

```

The compromised web site is bnoshop.com which has had a new file added, might.php.

This web page contains a redirection to another server.
This server in turn performs another redirection, to a web site like

```
http://404-health.eecim.com/enkogc/everyday/r-cla-safflower-oil/ or
http://160-healthandbeauty.brfvy.com/engdmk/everyday/we-pure-natural-forskolin/

```

So in these examples the actual web site containing the weight loss scam resides on the domain **eecim.com** or **brfvy.com**

## How they hide

A more recent example: If you load atezt.com you will see the Save The Children.org page.
But if you load http://413-healthandbeauty.atezt.com/enbsmd/everyday/we-pure-natural-forskolin/ you will see EveryDay Health & Wellness - the Forskolin scam.

## Fake: Use of references

### False Dr Oz claim

The claim "As Advertised On:" implies that the product was reported on by the television shows/stations or websites for which the logos are presented. This is an attempt to lend credibility to the product where none actually exists. The reference to Oprah Winfrey implies her endorsement, but that is a false claim.

Previously the same web sites had an identical format, with the exact same before and after photos and testimonials, but for another weight-loss scam - Caralluma. When this was revealed as a scam, they switched to Safflower Oil, but did not bother to change the images.

Refer to the web site DoctorOz.com to see if it is really recommended for weight loss. http://www.doctoroz.com/article/safflower-oil-use-fat-lose-fat states
*So, should you go out and start taking safflower oil products for weight loss? The answer, for now, is no. And why not? Because the approach is based primarily on the results of a single small study, a study whose weaknesses are significant.*

The claim of "personally recommended by Dr. Mike Moreno ... author of the 17 Day Diet" is nonsense. Furthermore, there is no reference to Safflower Oil in his 17 Day Diet.

### Misuse of stolen image

The before and after image of Kimberly Truesdell, who lost weight using only a change in diet to reduce calories, has been misused and attributed to Kristy, Miami FL.

## Technical analysis

Generally, the name servers that resolve access to the web site names are registered on the Russian country level. We have detected 300 such name servers, for example

```
ns1.caosiundre.ru
ns2.caosiundre.ru

```

```
ns1.cjaoijdsec.ru
ns2.cjaoijdsec.ru

```

```
ns1.cjnsoiuenrfser.ru
ns2.cjnsoiuenrfser.ru

```

```
ns1.ckjanosdi.ru
ns2.ckjanosdi.ru

```

The name servers reside on IP addresses located in various European countries.

A name server typically resolves addresses for between 5 and 15 names, which are usually in the format com-XXX.net where XXX comprises a random selection of alphanumeric characters. Later the convention changed to the format XXXXX.net or XXXXXX.net where again the name comprises a random selection of 5 or 6 alphanumeric characters.

## Sponsoring Registrars

Here is a list of domain names used in this scam, and the registrars who are sponsoring them. Many of the registrations contain false data. That puts the registrar in breach of the ICANN Registrar Accreditation Agreement.

### ALPNAMES LIMITED

```
axxsnf.com
ehxhm.com
kvngp.com
msxsse.com
nxhcev.com
oulhi.com
rnkmmc.com
vurkcj.com

```

### BIZCN.COM, INC.

```
epu1nt.net
icaty5.net
nofugb.net
vo93dv.net

```

### CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY CO., LTD.

```
akyjpf.com
bjcuoy.com
cebhy.com
ctmvc.com
dimucd.com
dkvlj.com
dlgil.com
dzvxh.com
ebfgn.com
fsbuu.com
fteju.com
fuixp.com
gckrxc.com
huymxm.com
ihruhj.com
jgsyu.com
lrmxr.com
ngetjd.com
ngouub.com
npygjr.com
pgibvg.com
pjinb.com
rernrk.com
rghce.com
splhus.com
ufytn.com
ujpms.com
vkzox.com
vlenu.com
zglnv.com

```

### ERANET INTERNATIONAL LIMITED

```
abmoi.com
grypzp.com
iobzau.com

```

### INTERNET DOMAIN SERVICE BS CORP

```
bjopmu.com
bkeabc.com
ctyzfi.com
fovtl.com
fsruio.com
gnlcej.com
hurvb.com
ikrfcd.net
jbapbp.net
lizrp.com
mmdag.com
ocuygh.com
paiznb.com
pujzsn.net
vafhme.net
ycbfbf.com

```

### NAUNET-RU

```
acmaosec.ru
adcoeewr.ru
adcwewe.ru
afkadiwcwe.ru
akcmosie.ru
akcmsoiec.ru
alckosiec.ru
ascisecas.ru
asidcwes.ru
asosiges.ru
cabecsec.ru
cagceces.ru
cagosien.ru
caisdcasecs.ru
cakosicse.ru
canosieca.ru
caosieca.ru
caosiecs.ru
caosiers.ru
caosiesece.ru
caosigse.ru
ccissesas.ru
chasfcegp.ru
cjnisugsecs.ru
ckagisecc.ru
ckaogise.ru
ckaosige.ru
ckjanosdi.ru
ckjnaosiu.ru
cknaogns.ru
ckogssec.ru
ckosiecaser.ru
ckosiecsr.ru
ckosigsc.ru
cksginsec.ru
cksgnscs.ru
cksigscc.ru
cksoigse.ru
clsgosie.ru
cmaosiease.ru
cmaosiefc.ru
cmgsecasc.ru
cmoaidfsraf.ru
cmoigsonfc.ru
cmosiecas.ru
cmosigseirsc.ru
cnaisoungs.ru
cnaosiue.ru
cnasrres.ru
cngscsec.ru
cnosigese.ru
coaigsierfscs.ru
cogsecse.ru
cosecsecs.ru
cosierrc.ru
cosises.ru
cscsercs.ru
csnociase.ru
csnoiacse.ru
csogiaces.ru
dcnoasecs.ru
dcosiejacse.ru
dkmoiscs.ru
dkncoiuj.ru
dkoaceace.ru
doiccase.ru
dvaosecs.ru
eacaoigezxe.ru
ecosiurcse.ru
gacsecse.ru
gacsniec.ru
gbanoogi.ru
hgacsecs.ru
ioncsefser.ru
kcnoaigs.ru
kcoaciecs.ru
kcoaicde.ru
kcoaigsecs.ru
kcoisdec.ru
kcoiserc.ru
kcosieca.ru
kgcoases.ru
kjcnoasie.ru
kloidsecse.ru
kmobkiaicsea.ru
kncoijnsec.ru
knmociser.ru
knmocisgse.ru
knvseoec.ru
lcasecse.ru
lkgnosnce.ru
mcasecas.ru
mcoisece.ru
mscseoas.ru
ncasiecs.ru
ndosigec.ru
nsocecsc.ru
ocisaercase.ru
pcoixgeser.ru
pkoincusn.ru
rckniersdr.ru
skcmosie.ru
smosiecse.ru
sngosiiec.ru
tacnusieca.ru
tcosigsers.ru
tgngasec.ru
uscnoisuec.ru
ybncsiuecs.ru

```

### PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

```
axxxmb.com
czvxny.com
dejcn.com
ftroox.com
upjgg.com

```

### R01-RU

```
cnasoijn.ru
cnedrsec.ru
coancac.ru
coasiescs.ru
cswdrecs.ru
doingsec.ru
dradfacs.ru
iecwsese.ru
ncefrdcs.ru
ngsocs.ru
oajngsc.ru
ockangs.ru
qswcnw.ru
sduuwcisag.ru

```

### TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM

```
ecdkvt.com
eecim.com
fadlc.com
gicue.com
gzonb.com
iayke.com
jhjrdp.com
ogfkb.com

```

# Suspended by the registrars

## 35 TECHNOLOGY CO., LTD

```
com-afp.net (suspended)
com-c4i.net (suspended)
com-o2f.net (suspended)

```

## BIZCN.COM, INC.

```
com-083.net (suspended)
com-its.net (suspended)
com-x7y.net (suspended)
com-zc2.net (suspended)

0gbdn1.net (suspended)
4pxpo0.net (suspended)
gt9dg7.net (suspended)
ltfdep.net (suspended)
rxu3go.net (suspended)
u8kvn2.net (suspended)
z3jdra.net (suspended)

```

## CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY

```
com-in8.net (suspended)
com-l4i.net (suspended)
com-lt5.net (suspended)
com-z1d.net (suspended)

```

## FOSHAN YIDONG NETWORK CO. LTD

```
1m11hp.net (suspended)
2x768k.net (suspended)
4epgv0.net (suspended)
8lxpvk.net (suspended)
aooeak.net (suspended)
jbp4ec.net (suspended)
u3nx2t.net (suspended)
vozcbt.net (suspended)

```

## HICHINA ZHICHENG TECHNOLOGY LTD.

```
com-05p.net (suspended)
com-0z7.net (suspended)
com-2sf.net (suspended)
com-52h.net (suspended)
com-b5g.net (suspended)
com-bng.net (suspended)
com-dif.net (suspended)
com-ekt.net (suspended)
com-ftf.net (suspended)
com-hbr.net (suspended)
com-hsx.net (suspended)
com-k11.net (suspended)
com-m4c.net (suspended)
com-mnz.net (suspended)
com-nfd.net (suspended)
com-oyf.net (suspended)
com-tng.net (suspended)
com-y92.net (suspended)
com-yzl.net (suspended)
com-z3o.net (suspended)

3gdnx1.net (suspended)
6j7y93.net (suspended)
7s8llc.net (suspended)
8cn2pg.net (suspended)
9bnusb.net (suspended)
9uy0mc.net (suspended)
a4jlod.net (suspended)
aiv7dt.net (suspended)
cnk3yt.net (suspended)
cs2s1m.net (suspended)
d9jyzn.net (suspended)
e7on3p.net (suspended)
fhclr3.net (suspended)
hol87h.net (suspended)
hsy8i6.net (suspended)
jfty4j.net (suspended)
mm3xzx.net (suspended)
o11lco.net (suspended)
uz9ybo.net (suspended)
v3hxi3.net (suspended)
vbbdyy.net (suspended)
x7rl0s.net (suspended)

```

## SHANGHAI MEICHENG TECHNOLOGY

```
com-8tm.net (suspended)
com-b89.net (suspended)
com-inl.net (suspended)
com-t53.net (suspended)
ihlts9.net (suspended)

```

## NAMESILO, LLC

```
com-5hr.net (suspended)
com-6e3.net (suspended)
com-0vh.net (suspended)
com-8fv.net (suspended)
com-01m.net (suspended)
com-10q.net (suspended)
com-14m.net (suspended)
com-30n.net (suspended)
com-622.net (suspended)
com-862.net (suspended)
com-8v0.net (suspended)
com-e6d.net (suspended)
com-f0p.net (suspended)
com-hgt.net (suspended)

```

## R01-RU

```
acdecs.ru
acnokjige.ru
aiojkn.ru
ajcniosjec.ru
ajncoisu.ru
akmcme.ru
aoixddse.ru
aosindf.ru
asgang.ru
asgaung.ru
asingec.ru
awscsag.ru
cdoacdgf.ru
cjdmvf.ru
cjeniosge.ru
cjneoasid.ru
cjnsoij.ru
ckaoidcse.ru
cloasuisf.ru
cnaosi.ru
cnaosicse.ru
cniajngse.ru
cnoisuje.ru
cnoking.ru
cnoseoc.ru
cnosknge.ru
coadie.ru
coidacs.ru
coiedcs.ru
coieddcs.ru
coinsecse.ru
coixsdcs.ru
cosincecws.ru
cosknge.ru
csoecos.ru
dafvjnoisj.ru
dageswfs.ru
dcajnoisj.ru
dcnisecsf.ru
deknciu.ru
dfcoesc.ru
dfjoaic.ru
dfodeace.ru
dfokqscse.ru
dfokxscse.ru
dfoxdace.ru
dginaodce.ru
dkoace.ru
dkoaice.ru
dkocase.ru
dkocoase.ru
dkoiaces.ru
dnedisecs.ru
dnixsecs.ru
doasige.ru
doicsec.ru
doqrfiecs.ru
dorfxiecs.ru
dsocoec.ru
edisdcs.ru
edoxdcwe.ru
edtgfjoaic.ru
efgang.ru
eingsse.ru
fgsncoe.ru
fgysec.ru
fvjcnoijs.ru
gacdsecse.ru
gaedsecs.ru
gaseczfs.ru
gaxsecs.ru
gbcjnisju.ru
ggdescse.ru
ghuecs.ru
gssfwcsef.ru
hancoieuc.ru
hgolsgs.ru
hgwseqgs.ru
hinoces.ru
hnjiecs.ru
hnkfnoide.ru
hnkoincse.ru
hodace.ru
iaonocs.ru
ihgdsdeq.ru
ihgdxsde.ru
itounde.ru
iutsbec.ru
jctnoiu.ru
jisecser.ru
jkijgnse.ru
jksnoics.ru
jmjndijcse.ru
jnijgse.ru
jniocjusc.ru
jnitjgse.ru
jnoiuse.ru
jrnsoij.ru
jsiescs.ru
jymjcae.ru
kchrtone.ru
kcmoigses.ru
kdaeoncs.ru
kdcoaec.ru
kdefoas.ru
kdfoas.ru
kdoaceac.ru
kdoacs.ru
kdoiacs.ru
kesoin.ru
kfoicecse.ru
kjcnoiu.ru
kmocsg.ru
kncoai.ru
kncosec.ru
knmcokg.ru
kockjinsoe.ru
koekjins.ru
kotdvce.ru
ktsnoics.ru
kwyedec.ru
lmoads.ru
loaedsuis.ru
loasxuis.ru
mdoiase.ru
mjbctae.ru
mjoeads.ru
mnocsec.ru
ncoisjncs.ru
ncoiuss.ru
ncosiecs.ru
ncoyges.ru
nedotgec.ru
nitjgse.ru
nsdozfec.ru
nseddoec.ru
ntmgos.ru
nycoaic.ru
oaswncb.ru
oavtsnc.ru
ocjnaouis.ru
oginscsse.ru
oindsecer.ru
oiounde.ru
oitounde.ru
osdribs.ru
osrrdud.ru
paubgise.ru
pedhgsgs.ru
phcgsgs.ru
phgsxgs.ru
pzhgsgs.ru
qaacjnios.ru
rcnoiu.ru
rjdmvf.ru
roioace.ru
salkcew.ru
scmoise.ru
scniosund.ru
sduwcisag.ru
sduxcisag.ru
sedcsag.ru
sedxidcd.ru
sekodce.ru
sescisag.ru
sgaxwng.ru
sgeang.ru
sgseoin.ru
sgsxsoin.ru
shgxdesc.ru
sinwscs.ru
skjnyhcons.ru
snmgos.ru
snofds.ru
snqoiqgdc.ru
sntmgos.ru
socodcs.ru
soicsgfis.ru
soiedsgfis.ru
soigsddc.ru
soisgfais.ru
soisxgfis.ru
ssfsoinoi.ru
sxkjncons.ru
tkntedcoai.ru
ucsiocs.ru
ucsops.ru
uigsecs.ru
uncisuge.ru
usediocs.ru
usedops.ru
usopas.ru
usxiocs.ru
utgdedoacs.ru
wafspce.ru
wafspuce.ru
wdtgiibuec.ru
wednoges.ru
wfsncoisec.ru
wfspece.ru
wgecsec.ru
wkoace.ru
wnfoisdcs.ru
wnsoij.ru
wnxoges.ru
wsarfoncs.ru
wsexidcd.ru
wsncoisec.ru
wswdidcd.ru
xdewlea.ru
yncadizfc.ru
yncuiosue.ru
ynedcadic.ru
ynxcadic.ru
zfspce.ru
zusiocs.ru

```

This operation would not be possible without the support of the registrars who provide services to the site owner.

## How to complain

Send a request to the registrar or ISP via email.

## Sources for this article

CLA Safflower oil scam

* http://en.wikipedia.org/wiki/Safflower
* http://www.doctoroz.com/article/safflower-oil-use-fat-lose-fat
* http://www.nutraingredients-usa.com/Research/CLA-community-hits-back-at-safflower-oil-claims-Science-wise-safflower-oil-is-not-a-serious-alternative-to-CLA-for-improved-body-composition

Caralluma scam

* Arora E, Khajuria V, Tandon VR, Sharma A, Mahajan A, Gillani ZH, Choudhary N. To evaluate efficacy and safety of Caralluma fimbriata in overweight and obese patients: A randomized, single blinded, placebo control trial. Perspect Clin Res [serial online] 2015 [cited 2015 Apr 21];6:39-44. Available from: http://www.picronline.org/text.asp?2015/6/1/39/148812

* Consumer reviews at highya.com