Monday, March 5, 2012

SCAM : YouTube Service sent you message:

Your video on the TOP of YouTube

YouTube Administration sent you a message: Illegal video warning

etc. etc

This is a new scam that is in rotation these days. BEWARE of this and try not clicking on the link provided.

This weekend I got an email whose subject is as follows---
YouTube Service has sent you a message:
Your video on the TOP of YouTube
You can reply to this message by visiting your inbox.

But on clicking the link and going to said URL. Somehow I didn't click on the click but copied URL to open it in different browser. I landed on a page giving me warning from Youtube itself.
The email originated from

I researched the 'headers' section of email and found the following:
It is spam. If you look at the headers, I guarantee you'll find that it was not sent by YouTube.

X-Apparently-To: via; Sun, 04 Mar 2012 19:17:50 -0800
Received-SPF: none (domain of does not designate permitted sender hosts) IG1lc3NhZ2U6IFlvdXIgdmlkZW8gb24gdGhlIFRPUCBvZiBZb3VUdWJlIAog IAoKICAKICAgIAoKICAgICAgCiAgICAgICAgCiAgICAgICAgICAKICAgICAg ICAgICAgCiAgICAgICAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICAg ICAgICBoZWxwIGNlbnRlcgogICAgICAgICAgfCBlLW1haWwgb3B0aW9ucwog ICAgICAgICAgICB8IHJlcG9ydCBzcGFtCiAgICAgICAgCiAgIAEwAQEBAQ--
X-YMailISG: QEsw7QEWLDs1NHRMTHBfsGRrVIRuCV3jp9QQ.7N9BUS7OCtJ fpQrxSU6fN_5nrgXbnAKvsXq3WvrSaqhptInsAhIJX23ZB.PiVlKXZU7ul6T J5Q35WZgKB88380z.7eloCBHqHdr4ytrgWmfMj8Y3ZcszbS9yS1N3wEdjG58 jCQGC9_mumP2_GNHbxVbshQ0lpqqf4Pzfb.UJh1228waZh.x8nRZqvFhNTQX hjIttKX5ykKEaDQCfh1WSvWv.mzZpbjehQ6y0uW7Vbzrta1hZV9AUZiBBB15 X5GrjPRZgN_yIIeFXuqWdEWbd2u7zKJgb2LR965l7uZtvwDBkF98eByJpCwZ 3bTSv12viIdpgsqsdW5525aqgJPJmUfH3j.E.Pi0wM2Xi2CV9pNc6jHTgICU eXswpS91gNJNDET3zNEb.wc2GOt4g8HMQze_4XB81eI3nChAPGE8OOgWQahs jJ_9EZ9DNnGArzaPL1.O68mjulZvfPaJQGdLJMfKsP95HP4OEk0R_RuEZesB A89i2xo1S_GbsmlJdc95Eq7Uw.sk63o4pJGGTmG.HLRXO1vUfTgBZ2FX_FQl ApTMeQAe.sKUCVS1K77.maxmh5hXfNHXul3ODqjCCToVU2RrplWEEKB4kYOA O2H7TJVtd3ceyp7LcVGqCGuDOHYsgrnGZH1M9jNdXXRTScbpGjjyZwcqg0y1 dsE3YwbUKUS1cUM.99kZ63SYTLmHs7fLTSLQFnnJ26jkWGq5Tcn5sStRtehI 1YedQwtU78Xl58JRnUIS8EG.QANKqx_goxcQPQGAbElbxsaQHBWD52Bpjp1y iS5JyW6txwYjhpAwa.AYs6zpAnNzfkraxDKBVc9xGM6XWOx0NA2GwPi0E20M pbjrhDkP_BtCQiGfNG7oeg7zMZ_4c_l1_0B28ITkHqUSXTSilEajB5GJ7Sqj 5ClClMo7UQfHve9NFJc.rN_9PAXhtc.H5hlGSnWysoIP5ac3wuFYdFLC3Mx_ yusPXC4marJ5Nis4Pk_IrVIGKuEhIIfOUVBjGgJTpDjougomLcjaGJHQkI3O AGnLWuIcBkkxh48-
X-Originating-IP: []
Authentication-Results:; domainkeys=neutral (no sig);; dkim=neutral (no sig)
Received: from (HELO ( by with SMTP; Sun, 04 Mar 2012 19:17:50 -0800
Content-Type: text/html; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Subject: YouTube Service sent you a message: Your video on the TOP of YouTube
From: YouTube Service Add sender to Contacts
Message-Id: <>
Date: Sun, 4 Mar 2012 22:17:46 +0200 (CEST)
Content-Length: 1835

So, now i was pretty much qualified to know that this is Scam.

Do also read Youtube Video Scam Support Page redirected from Discussions For IT People

Our Security Team headed by Mohd Anwar Jamal Faiz and Sadiyah Ozair tried to explore other areas where similar emails were in circulation.
(email us on and

Not to our surprise, Sadiyah deduced same problem even in Appstore emails. Its subject is "Your Order cancellation notification"

Many people have reported of getting similar emails. The return address is an "" address, which makes it look legit. The actual links in the one email someone got were different than the one i got, so it's probably a pre-manufactured template or something that a bunch of scammers are using. There's one of these from Apple App Store floating around, too. It reads "Your Order cancellation notification" or some such.

Happy Surfing
-Anwar faiz


  1. I have received several of these emails pretending to be YOU Tube..They even use the TRADEMARK!!

    You would think youtube(with the $$ they have) would find these spammers who are damaging their business and sue THEIR ass! This is AMERICA isn't it??!!

  2. truely said. but i guess it is hard to find. Tough butts to crack ==D