Yesterday I was really surprised to get the following message from one of my contacts:
> Check this out to find out if someone deleted you from their MSN: http://www.list-view.com
It obviously did not sound like him, more like an automated message, delivered from a bot. Of course, I did not click directly on the link (later I found that it would not cost any harm, but better safe than sorry). I preferred to copy/paste the link in one of my protected environments and see what will happen there.
The site, which I saw, had quite good, even professional design. However, they were asking __very strange__ question to me: to enter my MSN login data. As a return they promised to reveal me a big secret: to tell me which of my contacts deleted me from their contact lists.
Of course, I never gave them my Microsoft Passport credentials. And I do not advise any of you to give them. They claim that they do not store any personal information, but you can __never__ be sure of this. By giving them your Passport credentials you let them access any of your passport-related services. If you’re paid subscriber, you simply let them access your financial data as well.
To confirm my words I decided to query for “ScanMessenger” the site in Live Search. Obviously, the second found result was McAfee’s Site Advisor for scanmessenger.com. My suspicion was confirmed – Check Messenger / ScanMessenger is nothing more but fragulent site, designed to steal your Passport credentials.
If you spend some time clicking on its links, you will see that behind the shiny facade there’s nothing more but one “login” page. No matter where you click, you will either get “404 Not Found” error, or this login page. However, in order to ensure maximum coverage, they have this page translated into many languages (20 so far).
Will you get any real “service” from this site? Possibly. If you enter your credentials, this site will (at least) get your contact list from MSN, then it will send from your behalf the above message to all the people in your contact list. If the people in your contact list are stupid enough to do the same, the site will “know” that they have not deleted you yet. However, this “service” will fail if the people are smart enough not to give their Microsoft Passport credentials just to everyone, or if they have really deleted you from their contact list :).
What to do if you already visited the place and gave your credentials? I’d say the first thing should be to change your Passport password. Then, depending on which sensitive services you’re subscribed there, I’d advice you to go through all transaction-related data there and check your virtual (and maybe real too, if you have credit card info stored somewhere) money. And hope that all is OK. And learn to never give your credentials again.