ocean's InsecLab

More and more often we see websites that ask for your msn username and password to show you the contacts that have blocked you. This time a different message popped up, from xxxxx@hotmail.com to yyyyyy@hotmail.com:

xxxxxxx Hey check out the pics from the crazy party!! they are nuts LOL! go here to see

http://yyyyy.partypartypics.info

A quick whois shows us the IP of this website is 210.56.53.65, and tells us that the webserver is located in asia.

inetnum:      210.56.48.0 – 210.56.63.255
netname:      SUN-NETWORK
descr:        Sun Network (Hong Kong) Limited
descr:        Internet Service Provider in Hong Kong
country:      HK

a reverse DNS lookup reveals 27 domains registered on this server.

All these domains (and hundreds more, some of wich probably involved with myspace scam) are registered by “TST Management, Inc”. We can also see the terms of use/privacy policy:

We do not share your private information with any third parties.
By using our service/website  you hereby fully authorize TST Management, Inc to send messages
of a commercial nature via Instant Messages and E-Mails on behalf of third parties via the information
you provide us. This is not a “phishing” site that attempts to “trick” you into revealing personal
information. Everything we do with your information is disclosed here. If you are under eighteen (18),
you MUST obtain permission from a parent or guardian before using our website/service.
By filling out this form, you authorize TST Management, Inc to spread the word
about this 100% real and upcomming Messenger Community Site.
You will receive your share of the credit in helping us spread the word.  This is a harmless
Community site which is offering users a platform to meet each other for free.
…
We may temporarily access your MSN account to do a combination
of the following:
1.  Send Instant Messages to your friends promoting this site.
2.  Introduce new entertaining sites to your friends via Instant Messages.
…
TST Management, Inc reserves the right to change the terms of use / privacy policy
at any time without notice. To view the latest version of this privacy policy,
simply bookmark this page for future reference.
You understand that this agreement shall prevail if there is any conflict between this
agreement and the terms of use you accepted when you signed up with MSN. You also
understand that by temporarily accessing your msn account, TST Management, Inc
is NOT agreeing to MSN’s terms of use and therefore not bound by them.
This agreement shall be construed and governed by the law of the
republic of Panama. You expressly consent to the exclusive venue
and personal jurisdiction of the courts located in the Republic of
panama for any actions arising from or relating to this agreement.

If any provision of this agreement is held to be invalid, illegal or unenforceable
for any reason, such invalidity, illegality or unenforceability shall not effect any
other provisions of this agreement, and this agreement shall be construed as if
such invalid, illegal or unenforceable provision had not been contained herein.

Giving a quick look to the source we can also see that this website uses javascript to redirect us to some ads.

Maybe it’s better not to give your account and password to these websites, isn’t it? :P

Treat your password like your toothbrush. Don’t let anybody else use it, and get a new one every six months.
Clifford Stoll

thanks to emdel for help with this research, and to rockstar for proofreading.