The Securities and Exchange says it knows who was behind fake tender offers that were posted to its EDGAR database and is suing the Bulgarian man it says was behind them. On June 4, the SEC filed a complaint in U.S. District Court for the Southern District of New York against Nedko Nedev, 37, and firms he was associated with, PTG Capital Partners, PST Capital Group, Strategic Capital Partners Muster Limited, and Strategic Wealth Investments.

On May 14, at approximately 11:30 a.m., a PTG Capital Partners, allegedly a private equity firm, disclosed in a Section TO-C regulatory filing on the SEC’s EDGAR system, reporting that it had offered to buy Avon for $18.75 a share. In less than 30 minutes $91 million worth of Avon shares changed hands before trading was halted by the NYSE because there was no such offer and the disclosure was fradulent.

It isn’t the first time something of this sort has happened. In 2012, another fraudulent takeover bid for the Rocky Mountain Chocolate Factory was announced on EDGAR. The SEC places Nedev behind that scheme as well as a similar effort in 2014 to manipulate the stock price of insurance company Tower Group International by issuing a fake press release announcing that it was the target of a takeover bid.

“Nedev’s trading in connection with these three market manipulations demonstrates that he or others working with him attempted to manipulate the equity price of these three issuers by issuing fraudulent tender offers or press releases,” the SEC says in its complaint.

“Nedev traded equity positions in all three issuers,” the court filing says. “It is highly unlikely that [his] trading was mere coincidence given that the manipulation occurred over four years, involved very different issuers, and occurred in at least one lightly-traded stock.” The complaint also points to wording that appears in connection to the related EDGAR filings and press release, and numerous Bulgarian connections. The IP address used to disclose Avon and Rocky Mountain Chocolate Factory Tender offers show that the documents were uploaded from Bulgaria.

The SEC is seeking a monetary fine and discouragement of profits made from the stock manipulation.