The Doctors or Everyday Health & Wellness or Women's Health

You may also see this as a redirection to "SavetheChildren.org" but that is a clever trick to make you think they are legitimate.

This scam has been exposed at many different locations on the Internet.

It has appeared as a Caralluma weight-loss scam, a Forskolin Fuel weight-loss scam, as a Safflower Oil weight-loss scam, and Garcinia fraud, varying by date and even by geography. The same claims were made, using identical before-and-after pictures for different scams.

Safflower Oil exposed as a scam


The front page of the EveryDay website

The front page of The Safflower Doctors website

The front page of Safflower website

The front page of Women's Health website


Analysis[edit | edit source]

Relentlessly spammed in the April - November 2015 time-frame, "The Doctors" tries to avoid blacklisting by anti-spam tools and reputation services (such as MyWot and McAfee SiteAdvisor).

Basic summary[edit | edit source]

"The Doctors" (EveryDay Health & Wellness) is a highly spammed operation promoting what claims to be a weight-loss product.

It sells one product: either Caralluma or CLA Safflower oil or Forskolin Fuel or Garcinia. The Wikipedia entry does not agree with the claims on Safflower oil - Wkipedia on Safflower

Sample spam[edit | edit source]

<a href="http://bnoshop.com/might.php"><a href="http://bnoshop.com/might.php" 
       target="_blank">http://bnoshop.com/might.php</a></a>   <br><br><br>Michael 
       Wilson<br><a href="https://yho.com/footer0">Sent from Yahoo Mail for iPhone</a><br>

Analysis of the spam[edit | edit source]

The last line has a link to a compromised web site:

bnoshop.com/might.php

The compromised web site is bnoshop.com which has had a new file added, might.php.

This web page contains a redirection to another server. This server in turn performs another redirection, to a web site like

http://404-health.eecim.com/enkogc/everyday/r-cla-safflower-oil/ or
http://160-healthandbeauty.brfvy.com/engdmk/everyday/we-pure-natural-forskolin/

So in these examples the actual web site containing the weight loss scam resides on the domain eecim.com or brfvy.com

How they hide[edit | edit source]

A more recent example: If you load atezt.com you will see the Save The Children.org page. But if you load http://413-healthandbeauty.atezt.com/enbsmd/everyday/we-pure-natural-forskolin/ you will see EveryDay Health & Wellness - the Forskolin scam.

Fake: Use of references[edit | edit source]

False Dr Oz claim[edit | edit source]

The checkout for Safflower Doctors website

The claim "As Advertised On:" implies that the product was reported on by the television shows/stations or websites for which the logos are presented. This is an attempt to lend credibility to the product where none actually exists. The reference to Oprah Winfrey implies her endorsement, but that is a false claim.

Previously the same web sites had an identical format, with the exact same before and after photos and testimonials, but for another weight-loss scam - Caralluma. When this was revealed as a scam, they switched to Safflower Oil, but did not bother to change the images.

Refer to the web site DoctorOz.com to see if it is really recommended for weight loss. http://www.doctoroz.com/article/safflower-oil-use-fat-lose-fat states So, should you go out and start taking safflower oil products for weight loss? The answer, for now, is no. And why not? Because the approach is based primarily on the results of a single small study, a study whose weaknesses are significant.

The claim of "personally recommended by Dr. Mike Moreno ... author of the 17 Day Diet" is nonsense. Furthermore, there is no reference to Safflower Oil in his 17 Day Diet.


Identical claims for different products[edit | edit source]

Caralluma site, same claims

Forskolin site, same claims

Misuse of stolen image[edit | edit source]

Kimberly Truesdell picture

The before and after image of Kimberly Truesdell, who lost weight using only a change in diet to reduce calories, has been misused and attributed to Kristy, Miami FL.

Technical analysis[edit | edit source]

Generally, the name servers that resolve access to the web site names are registered on the Russian country level. We have detected 300 such name servers, for example

ns1.caosiundre.ru
ns2.caosiundre.ru
ns1.cjaoijdsec.ru
ns2.cjaoijdsec.ru
ns1.cjnsoiuenrfser.ru
ns2.cjnsoiuenrfser.ru
ns1.ckjanosdi.ru
ns2.ckjanosdi.ru



The name servers reside on IP addresses located in various European countries.

A name server typically resolves addresses for between 5 and 15 names, which are usually in the format com-XXX.net where XXX comprises a random selection of alphanumeric characters. Later the convention changed to the format XXXXX.net or XXXXXX.net where again the name comprises a random selection of 5 or 6 alphanumeric characters.


Sponsoring Registrars[edit | edit source]

Live Sites

Suspensions

Here is a list of domain names used in this scam, and the registrars who are sponsoring them. Many of the registrations contain false data. That puts the registrar in breach of the ICANN Registrar Accreditation Agreement.


ALPNAMES LIMITED[edit | edit source]

axxsnf.com
ehxhm.com
kvngp.com
msxsse.com
nxhcev.com
oulhi.com
rnkmmc.com
vurkcj.com

BIZCN.COM, INC.[edit | edit source]

epu1nt.net
icaty5.net
nofugb.net
vo93dv.net

CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY CO., LTD.[edit | edit source]

akyjpf.com
bjcuoy.com
cebhy.com
ctmvc.com
dimucd.com
dkvlj.com
dlgil.com
dzvxh.com
ebfgn.com
fsbuu.com
fteju.com
fuixp.com
gckrxc.com
huymxm.com
ihruhj.com
jgsyu.com
lrmxr.com
ngetjd.com
ngouub.com
npygjr.com
pgibvg.com
pjinb.com
rernrk.com
rghce.com
splhus.com
ufytn.com
ujpms.com
vkzox.com
vlenu.com
zglnv.com

ERANET INTERNATIONAL LIMITED[edit | edit source]

abmoi.com
grypzp.com
iobzau.com

INTERNET DOMAIN SERVICE BS CORP[edit | edit source]

bjopmu.com
bkeabc.com
ctyzfi.com
fovtl.com
fsruio.com
gnlcej.com
hurvb.com
ikrfcd.net
jbapbp.net
lizrp.com
mmdag.com
ocuygh.com
paiznb.com
pujzsn.net
vafhme.net
ycbfbf.com

NAUNET-RU[edit | edit source]

acmaosec.ru
adcoeewr.ru
adcwewe.ru
afkadiwcwe.ru
akcmosie.ru
akcmsoiec.ru
alckosiec.ru
ascisecas.ru
asidcwes.ru
asosiges.ru
cabecsec.ru
cagceces.ru
cagosien.ru
caisdcasecs.ru
cakosicse.ru
canosieca.ru
caosieca.ru
caosiecs.ru
caosiers.ru
caosiesece.ru
caosigse.ru
ccissesas.ru
chasfcegp.ru
cjnisugsecs.ru
ckagisecc.ru
ckaogise.ru
ckaosige.ru
ckjanosdi.ru
ckjnaosiu.ru
cknaogns.ru
ckogssec.ru
ckosiecaser.ru
ckosiecsr.ru
ckosigsc.ru
cksginsec.ru
cksgnscs.ru
cksigscc.ru
cksoigse.ru
clsgosie.ru
cmaosiease.ru
cmaosiefc.ru
cmgsecasc.ru
cmoaidfsraf.ru
cmoigsonfc.ru
cmosiecas.ru
cmosigseirsc.ru
cnaisoungs.ru
cnaosiue.ru
cnasrres.ru
cngscsec.ru
cnosigese.ru
coaigsierfscs.ru
cogsecse.ru
cosecsecs.ru
cosierrc.ru
cosises.ru
cscsercs.ru
csnociase.ru
csnoiacse.ru
csogiaces.ru
dcnoasecs.ru
dcosiejacse.ru
dkmoiscs.ru
dkncoiuj.ru
dkoaceace.ru
doiccase.ru
dvaosecs.ru
eacaoigezxe.ru
ecosiurcse.ru
gacsecse.ru
gacsniec.ru
gbanoogi.ru
hgacsecs.ru
ioncsefser.ru
kcnoaigs.ru
kcoaciecs.ru
kcoaicde.ru
kcoaigsecs.ru
kcoisdec.ru
kcoiserc.ru
kcosieca.ru
kgcoases.ru
kjcnoasie.ru
kloidsecse.ru
kmobkiaicsea.ru
kncoijnsec.ru
knmociser.ru
knmocisgse.ru
knvseoec.ru
lcasecse.ru
lkgnosnce.ru
mcasecas.ru
mcoisece.ru
mscseoas.ru
ncasiecs.ru
ndosigec.ru
nsocecsc.ru
ocisaercase.ru
pcoixgeser.ru
pkoincusn.ru
rckniersdr.ru
skcmosie.ru
smosiecse.ru
sngosiiec.ru
tacnusieca.ru
tcosigsers.ru
tgngasec.ru
uscnoisuec.ru
ybncsiuecs.ru

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM[edit | edit source]

axxxmb.com
czvxny.com
dejcn.com
ftroox.com
upjgg.com

R01-RU[edit | edit source]

cnasoijn.ru
cnedrsec.ru
coancac.ru
coasiescs.ru
cswdrecs.ru
doingsec.ru
dradfacs.ru
iecwsese.ru
ncefrdcs.ru
ngsocs.ru
oajngsc.ru
ockangs.ru
qswcnw.ru
sduuwcisag.ru

TURNCOMMERCE, INC. DBA NAMEBRIGHT.COM[edit | edit source]

ecdkvt.com
eecim.com
fadlc.com
gicue.com
gzonb.com
iayke.com
jhjrdp.com
ogfkb.com

Suspended by the registrars[edit | edit source]

35 TECHNOLOGY CO., LTD[edit | edit source]

com-afp.net (suspended)
com-c4i.net (suspended)
com-o2f.net (suspended)


BIZCN.COM, INC.[edit | edit source]

com-083.net (suspended)
com-its.net (suspended)
com-x7y.net (suspended)
com-zc2.net (suspended)

0gbdn1.net (suspended)
4pxpo0.net (suspended)
gt9dg7.net (suspended)
ltfdep.net (suspended)
rxu3go.net (suspended)
u8kvn2.net (suspended)
z3jdra.net (suspended)


CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY[edit | edit source]

com-in8.net (suspended)
com-l4i.net (suspended)
com-lt5.net (suspended)
com-z1d.net (suspended)

FOSHAN YIDONG NETWORK CO. LTD[edit | edit source]

1m11hp.net (suspended)
2x768k.net (suspended)
4epgv0.net (suspended)
8lxpvk.net (suspended)
aooeak.net (suspended)
jbp4ec.net (suspended)
u3nx2t.net (suspended)
vozcbt.net (suspended)


HICHINA ZHICHENG TECHNOLOGY LTD.[edit | edit source]

com-05p.net (suspended)
com-0z7.net (suspended)
com-2sf.net (suspended)
com-52h.net (suspended)
com-b5g.net (suspended)
com-bng.net (suspended)
com-dif.net (suspended)
com-ekt.net (suspended)
com-ftf.net (suspended)
com-hbr.net (suspended)
com-hsx.net (suspended)
com-k11.net (suspended)
com-m4c.net (suspended)
com-mnz.net (suspended)
com-nfd.net (suspended)
com-oyf.net (suspended)
com-tng.net (suspended)
com-y92.net (suspended)
com-yzl.net (suspended)
com-z3o.net (suspended)

3gdnx1.net (suspended)
6j7y93.net (suspended)
7s8llc.net (suspended)
8cn2pg.net (suspended)
9bnusb.net (suspended)
9uy0mc.net (suspended)
a4jlod.net (suspended)
aiv7dt.net (suspended)
cnk3yt.net (suspended)
cs2s1m.net (suspended)
d9jyzn.net (suspended)
e7on3p.net (suspended)
fhclr3.net (suspended)
hol87h.net (suspended)
hsy8i6.net (suspended)
jfty4j.net (suspended)
mm3xzx.net (suspended)
o11lco.net (suspended)
uz9ybo.net (suspended)
v3hxi3.net (suspended)
vbbdyy.net (suspended)
x7rl0s.net (suspended)


SHANGHAI MEICHENG TECHNOLOGY[edit | edit source]

com-8tm.net (suspended)
com-b89.net (suspended)
com-inl.net (suspended)
com-t53.net (suspended)
ihlts9.net (suspended)

NAMESILO, LLC[edit | edit source]

com-5hr.net (suspended)
com-6e3.net (suspended)
com-0vh.net (suspended)
com-8fv.net (suspended)
com-01m.net (suspended)
com-10q.net (suspended)
com-14m.net (suspended)
com-30n.net (suspended)
com-622.net (suspended)
com-862.net (suspended)
com-8v0.net (suspended)
com-e6d.net (suspended)
com-f0p.net (suspended)
com-hgt.net (suspended)

R01-RU[edit | edit source]

acdecs.ru
acnokjige.ru
aiojkn.ru
ajcniosjec.ru
ajncoisu.ru
akmcme.ru
aoixddse.ru
aosindf.ru
asgang.ru
asgaung.ru
asingec.ru
awscsag.ru
cdoacdgf.ru
cjdmvf.ru
cjeniosge.ru
cjneoasid.ru
cjnsoij.ru
ckaoidcse.ru
cloasuisf.ru
cnaosi.ru
cnaosicse.ru
cniajngse.ru
cnoisuje.ru
cnoking.ru
cnoseoc.ru
cnosknge.ru
coadie.ru
coidacs.ru
coiedcs.ru
coieddcs.ru
coinsecse.ru
coixsdcs.ru
cosincecws.ru
cosknge.ru
csoecos.ru
dafvjnoisj.ru
dageswfs.ru
dcajnoisj.ru
dcnisecsf.ru
deknciu.ru
dfcoesc.ru
dfjoaic.ru
dfodeace.ru
dfokqscse.ru
dfokxscse.ru
dfoxdace.ru
dginaodce.ru
dkoace.ru
dkoaice.ru
dkocase.ru
dkocoase.ru
dkoiaces.ru
dnedisecs.ru
dnixsecs.ru
doasige.ru
doicsec.ru
doqrfiecs.ru
dorfxiecs.ru
dsocoec.ru
edisdcs.ru
edoxdcwe.ru
edtgfjoaic.ru
efgang.ru
eingsse.ru
fgsncoe.ru
fgysec.ru
fvjcnoijs.ru
gacdsecse.ru
gaedsecs.ru
gaseczfs.ru
gaxsecs.ru
gbcjnisju.ru
ggdescse.ru
ghuecs.ru
gssfwcsef.ru
hancoieuc.ru
hgolsgs.ru
hgwseqgs.ru
hinoces.ru
hnjiecs.ru
hnkfnoide.ru
hnkoincse.ru
hodace.ru
iaonocs.ru
ihgdsdeq.ru
ihgdxsde.ru
itounde.ru
iutsbec.ru
jctnoiu.ru
jisecser.ru
jkijgnse.ru
jksnoics.ru
jmjndijcse.ru
jnijgse.ru
jniocjusc.ru
jnitjgse.ru
jnoiuse.ru
jrnsoij.ru
jsiescs.ru
jymjcae.ru
kchrtone.ru
kcmoigses.ru
kdaeoncs.ru
kdcoaec.ru
kdefoas.ru
kdfoas.ru
kdoaceac.ru
kdoacs.ru
kdoiacs.ru
kesoin.ru
kfoicecse.ru
kjcnoiu.ru
kmocsg.ru
kncoai.ru
kncosec.ru
knmcokg.ru
kockjinsoe.ru
koekjins.ru
kotdvce.ru
ktsnoics.ru
kwyedec.ru
lmoads.ru
loaedsuis.ru
loasxuis.ru
mdoiase.ru
mjbctae.ru
mjoeads.ru
mnocsec.ru
ncoisjncs.ru
ncoiuss.ru
ncosiecs.ru
ncoyges.ru
nedotgec.ru
nitjgse.ru
nsdozfec.ru
nseddoec.ru
ntmgos.ru
nycoaic.ru
oaswncb.ru
oavtsnc.ru
ocjnaouis.ru
oginscsse.ru
oindsecer.ru
oiounde.ru
oitounde.ru
osdribs.ru
osrrdud.ru
paubgise.ru
pedhgsgs.ru
phcgsgs.ru
phgsxgs.ru
pzhgsgs.ru
qaacjnios.ru
rcnoiu.ru
rjdmvf.ru
roioace.ru
salkcew.ru
scmoise.ru
scniosund.ru
sduwcisag.ru
sduxcisag.ru
sedcsag.ru
sedxidcd.ru
sekodce.ru
sescisag.ru
sgaxwng.ru
sgeang.ru
sgseoin.ru
sgsxsoin.ru
shgxdesc.ru
sinwscs.ru
skjnyhcons.ru
snmgos.ru
snofds.ru
snqoiqgdc.ru
sntmgos.ru
socodcs.ru
soicsgfis.ru
soiedsgfis.ru
soigsddc.ru
soisgfais.ru
soisxgfis.ru
ssfsoinoi.ru
sxkjncons.ru
tkntedcoai.ru
ucsiocs.ru
ucsops.ru
uigsecs.ru
uncisuge.ru
usediocs.ru
usedops.ru
usopas.ru
usxiocs.ru
utgdedoacs.ru
wafspce.ru
wafspuce.ru
wdtgiibuec.ru
wednoges.ru
wfsncoisec.ru
wfspece.ru
wgecsec.ru
wkoace.ru
wnfoisdcs.ru
wnsoij.ru
wnxoges.ru
wsarfoncs.ru
wsexidcd.ru
wsncoisec.ru
wswdidcd.ru
xdewlea.ru
yncadizfc.ru
yncuiosue.ru
ynedcadic.ru
ynxcadic.ru
zfspce.ru
zusiocs.ru

This operation would not be possible without the support of the registrars who provide services to the site owner.

How to complain[edit | edit source]

Send a request to the registrar or ISP via email.

Sources for this article[edit | edit source]

CLA Safflower oil scam


Caralluma scam

  • Arora E, Khajuria V, Tandon VR, Sharma A, Mahajan A, Gillani ZH, Choudhary N. To evaluate efficacy and safety of Caralluma fimbriata in overweight and obese patients: A randomized, single blinded, placebo control trial. Perspect Clin Res [serial online] 2015 [cited 2015 Apr 21];6:39-44. Available from: http://www.picronline.org/text.asp?2015/6/1/39/148812
Community content is available under CC-BY-SA unless otherwise noted.