Messenger phishing

The Checkmessenger scam

If you get a message like those two shown below, then beware!

"Find out who deleted you from the MSN without noticing it. Check your MSN and verify who deleted you from their Messenger account."

"Do you want to know why some contacts are never online? Do you want to find out who removed you from his/her contact list? Messenger-Tips.com answers these questions easily and risk free. Enter your MSN account and password and we will tell you who has left you out from their lives. Your MSN client will disconnect while this information is retrieved. Then, your contact list will be displayed and you will know the truth."

The thruth? Near the end of a long FAQ you can read: "By using the Online Delete Checker you authorize Messenger-Tips to send Instant Messages on your behalf to your online contacts advertising the site."

But the faq does not reveal how many times this will happen, nor how often. Basically you're accepting that all of your friends and contacts will be spammed. Furthermore you have only their word, that your password will be deleted immediately after use...

What if you wanted to complain? To quote Dean/Siteadvisor: "Of course, you should reveal this information to a web site that's devoid of any contact information and has registered their web site through Domains by Proxy, right? The only thing lacking here is a free headband that has the word "sucker" on it in bold letters..."

Who is behind?

Either the registrant has chosen to remain anonymous, or it is:

Virtus Offshore Investment Co.
Suite 2007 20th Floor
The Century Tower
Ave Ricardo J. Alfaro
Panama City. Panama.
Mail: private@voichaven.com
Phone: +507.2051616

IP locations variate:
California or Arizona or Netherlands or Malaysia or ?

Furthermore

At first sight this could look like a legal company, giving some information away for free, getting payed by a few ads. However, here's a new website by Virtus Offshore Investment:

signin2ebay-ebaymotors-ws-ebayisapii1.com

If this smells like eBay phishing, you're quite right! Therefore, I'll now conclude: If you give these criminals your Messenger password, you can be sure that it will be abused, all your friends will be spammed 'on your behalf', and the spam could include vira, trojans, worms, spyware and other malware...

Update

February 08: This scam is still active. Now spreading to other languages than english:

Chinese
Danish
Dutch
Finnish
French
German
Hebrew
Italian
Japanese
Korean
Norwegian
Portuguese
Polish
Russian
Spanish
Swedish
Turkish
and more...

Earlier scam sites (now dead)

midwaycover.com
multicl-expeditions.com

By the way, if you wonder what the TK domain refers to? It's Tokelau, a non-self-governing colonial territory of New Zealand, 3 tropical coral atolls in the South Pacific Ocean...

Messenger phishing

The Checkmessenger scam

Who is behind?

Furthermore

Update

Beware of these IM phishing sites

Other scam sites by Virtus Offshore

Earlier scam sites (now dead)