Henwood Business Solutions Fraud
Report
Active
Domain
Don't Bear Internet Fraud
Home
Bobbear Icon
Henwood Business Solutions Logo.
This Henwood Business Solutions scam is related to several other web based and email based frauds including Trust Company Inc., Finance International, E-Z Transfer, SurRate Inc, Des Group Inc., Business & Professional Consultants Inc., Renaissance Capital Advisors Ltd., and no doubt many others, in other words it's a standard run-of-the mill, patently transparent money transfer fraud of the type that are turned out by the dozen by the same bunch of criminals using the same hosts and registrars that they regularly use.

This fraudster bears no relation to any other company of a similar name and should not be confused. The above website graphics and the money laundering job below identify this fraudster.

Henwood Business Solutions. : Evidence of Criminal Fraud

i)  Their claimed address on their website is:
    261 Broadway
    New York, NY 10007
    United States
    This is certainly a Bank of America location, but not a location for these crooks.

ii) In the 'president's word' they claim to have a "15 year history", yet the domain henwoodbs.com was only registered with Melbourne IT, (as were all the other scammers domains listed), on 28-nov-2007

iii) The only hits Google throws up for "Henwood Business Solutions." are for a generator company - they have no internet presence at all which is odd when you consider their claim: "Henwood Business Solutions is managed by companies from various branches of economy. In 2005 the business value increased by 70% in comparison with the previous year with the annual turnover exceeding 6 billion USD". It is plainly a lie.

iv) This fraudster's website has an alternate alias of Carroll Business Solutions whose site has been disabled. There are also numerous other fraudulent aliases.

v) They are hosted on the Yahoo small business network currently favoured by these criminals.

vi) The real function of the website is to advertise this money mule 'job' of 'Financial Agent':

Financial Agent

EXPECTATIONS FROM CANDIDATE: What we offer: If you are interested in this opening, please send your CV at job@henwoodbs.com or fill out the special Form in our site.
In other words, just your average money laundering mule position.

viii) No legitimate company would use private individuals to transfer money in this way using private bank accounts. To do so is illegal and defines the company as both bogus and criminal.

The above evidence clearly demonstrates beyond any doubt that the  Henwood Business Solutions website has been set up by money laundering fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal money laundering activity and spamming - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.
Henwood Business Solutions Fraudsters - current hosting details [Updated 1st. January 2008]

Current Main Domains, Hosts and  Registrars
Domain

henwoodbs.com		 Registrar

Melbourne IT		 Host Network

Yahoo Small Business Network 		Host IP

See DNS data below

See table below for the full list of known active & suspended main domains used by this criminal.
Please notify me of any other current domains used by this criminal.
Current Botnet Nameserver Domains and Registrars
Not botnet hosted at present - DNS data below. See table below for the full list of known active & suspended nameserver domains for this criminal.
The Spam Headers

Fresh spam required, full source code please or as an attachment.

The Spam Content

Fresh spam required, full source code please or as an attachment.

The Zombie Botnet

The criminal as not using a zombie botnet at this time. Normal DNS Data below.
Initial DNS Data (henwoodbs.com)

How I am searching:

Searching for henwoodbs.com A record at e.root-servers.net [192.203.230.10]: Got referral to I.GTLD-SERVERS.NET. (zone: com.)
Searching for henwoodbs.com A record at I.GTLD-SERVERS.NET. [192.43.172.30]: Got referral to yns1.yahoo.com. (zone: henwoodbs.com.)
Searching for henwoodbs.com A record at yns1.yahoo.com. [66.218.71.205]: Reports henwoodbs.com. Response:
Domain Type Class TTL Answer
henwoodbs.com. A IN 1200 216.39.58.201
henwoodbs.com. A IN 1200 216.39.58.202
henwoodbs.com. A IN 1200 216.39.58.203
henwoodbs.com. A IN 1200 216.39.58.204
henwoodbs.com. A IN 1200 216.39.58.205
henwoodbs.com. A IN 1200 216.39.58.206
henwoodbs.com. NS IN 86400 yns2.yahoo.com.
henwoodbs.com. NS IN 86400 ns8.san.yahoo.com.
henwoodbs.com. NS IN 86400 ns9.san.yahoo.com.
henwoodbs.com. NS IN 86400 yns1.yahoo.com.
ns8.san.yahoo.com. A IN 1800 66.218.71.205
ns9.san.yahoo.com. A IN 1800 216.109.116.20
yns1.yahoo.com. A IN 1800 66.218.71.205
yns2.yahoo.com. A IN 1800 216.109.116.20
 
Looking up at the 2 henwoodbs.com. parent servers:

Server Response Time
yns2.yahoo.com [216.109.116.20]  216.39.58.197 216.39.58.198 216.39.58.199 216.39.58.200 216.39.58.201 216.39.58.202 45ms
yns1.yahoo.com [66.218.71.205]  216.39.58.206 216.39.58.207 216.39.58.208 216.39.58.209 216.39.58.235 216.39.58.236 62ms

The DNS data shows the all too familiar Yahoo 'small business' network so often used by these criminals.

Here are all of the known domains that are/have been used for the Henwood Business Solutions fraud:
Domain

henwoodbs.com

 Status

Active

 		Registrar

Melbourne IT

Please notify me of any errors or domains not listed here.

i) The criminal will not respond to your challenge, but will use the notice to prepare a new network - immediate suspension is requested please, if allowed for by your AUP.

Fraud Blog

Initial entry 31st. December 2007