View Full Version : WTF?! 419 scam (pretendiing to come) from ubuntu-annouce mailing list??

February 23rd, 2006, 01:42 PM

Today I received the following message on my gmail account, pretending to be coming from the ubuntu-annouce mailing list (to which I subscribe to) - see attached message.

The topic sounds so much like a 419 scam: broken English, fantastic winning on a lottery when I never play any lottery....

However, it is somewhat more sophisticated as it managed to get around gmail spam filters by pretending to come from a mailing list I subscribe to (I am still in shock, usually the filters are flawless and catch all the ebay phishing scams etc with no problems).

1. Has anyone else received this?
2. Is it an announcement from Ubuntu to be careful about this scam, why there are no words of warning?
3. Do you think that my system compromised?
4. Do you suggest that I report this to gmail, ubuntu-announce or to someone else?


X-Gmail-Received: 7a5973339a78c12c3c58ece714d6655d7eaa0d7e
Delivered-To: XXXXXX@gmail.com
Received: by with SMTP id f9cs1498nfe;
Thu, 23 Feb 2006 04:04:07 -0800 (PST)
Received: by with SMTP id y1mr7036096wxa;
Thu, 23 Feb 2006 04:03:27 -0800 (PST)
Return-Path: <ubuntu-announce-bounces@lists.ubuntu.com>
Received: from esperanza.ubuntu.com (esperanza.ubuntu.com [])
by mx.gmail.com with ESMTP id i19si186799wxd.2006.;
Thu, 23 Feb 2006 04:03:27 -0800 (PST)
Received-SPF: pass (gmail.com: domain of ubuntu-announce-bounces@lists.ubuntu.com designates as permitted sender)
Received: from localhost ([] helo=esperanza.ubuntu.com)
by esperanza.ubuntu.com with esmtp (Exim 4.52)
id 1FCF92-0002rD-N4; Thu, 23 Feb 2006 12:00:28 +0000
From: ubuntu-announce-request@lists.ubuntu.com
Subject: ubuntu-announce Digest, Vol 16, Issue 4
To: ubuntu-announce@lists.ubuntu.com
Reply-To: ubuntu-announce@lists.ubuntu.com
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-BeenThere: ubuntu-announce@lists.ubuntu.com
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Ubuntu Announcements <ubuntu-announce.lists.ubuntu.com>
List-Unsubscribe: <https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce>,
List-Archive: <https://lists.ubuntu.com/archives/ubuntu-announce>
List-Post: <mailto:ubuntu-announce@lists.ubuntu.com>
List-Help: <mailto:ubuntu-announce-request@lists.ubuntu.com?subject=help>
List-Subscribe: <https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce>,
Sender: ubuntu-announce-bounces@lists.ubuntu.com
Errors-To: ubuntu-announce-bounces@lists.ubuntu.com
Message-Id: <E1FCF92-0002rD-N4@esperanza.ubuntu.com>
Date: Thu, 23 Feb 2006 12:00:28 +0000

Send ubuntu-announce mailing list submissions to

To subscribe or unsubscribe via the World Wide Web, visit
or, via email, send a message with subject or body 'help' to

You can reach the person managing the list at

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-announce digest..."

Today's Topics:

1. LOTTO.: CONTACT SMITH FIRM!!! (inffooffice@virgilio.it)


Message: 1
Date: Wed, 22 Feb 2006 14:25:32 +0100 (GMT+01:00)
From: <inffooffice@virgilio.it>
Message-ID: <20021177.1140614732659.JavaMail.root@pswm7.cp.tin. it>
Content-Type: text/plain;charset="UTF-8"

2391 Beds 152 Koningin Julianaplein 21,
Den Haag, the Netherlands.
(Lotto affiliate with Subscriber Agents).
From: Susan Console
(Lottery Coordinator)



We are pleased to inform you of the result of the
Lotto NL Winners International programs held on the 22th of February,
2006, which drew a cash prize of $1,000,000.00, covered with high
insurance policy. Your e-mail address attached to Ticket/Code number
0087411652337 with claim/reference number 085093785/92 drew these lucky
numbers 007-49746-041-764-64-2091, which consequently won in the 1st
category. You have been approved to receive a cash prize of
$1,000,000.00 (One Million USD).

Be informed because of mix up in
cash pay-outs, we ask that you keep your winning information
confidential until your fund ($1,000,000.00) has been fully remitted to
you by our accredited pay-point bank. This measure must be adhere to
avoid loss of your cash prize - winners of our cash prizes are advised
to adhere to these instructions to forestall the abuse of this program
by other participants. It's important to note that this draws were
conducted formally, and winners are selected through an internet ballot
system from 60,000 individual and companies e-mail addresses - the
draws are conducted around the world through our internet based ballot
system. The promotion is sponsored and promoted by Lotto NL.

congratulate you once again. We hope you will use part of it in our
next draws; the jackpot winning is $85million. Remember, all winning
must be claimed not later than 20 days. After this date all unclaimed
cash prize will be forfeited and included in the next sweepstake.
Please, in order to avoid unnecessary delays and complications remember
to quote your winning numbers in all correspondence with us.

Congratulations once again from all members of Lotto NL. Thank you for
being part of our promotional program.

For immediate release of your
cash prize, please kindly contact Smith Firm {Imperial Chamber}

Advocate Mr. Van Der Gooi
Advocate Mrs. G.
F Saskia
Dr. Edward Makad
EMAIL: smithlaws5@excite.com
Tel: +31-613-795-051 Fax: +31-847-275-995

Congratulations once again.

Yours Sincerely,
Mrs. Susan Console
(Lottery Coordinator)

February 23rd, 2006, 01:45 PM
Well, theyre not the smartest of people...they'll send their scam to anyone, and anything.


February 23rd, 2006, 02:18 PM
I got the same thing!

And mistakenly posted another thread about it... doh!

Anywho, yea what is the deal here?

February 23rd, 2006, 02:31 PM
No deal whatsoever, for you at least.

They are trying to have people call them (premium number) and/or collecting their mailbox details for spamming/identity fraud/phishing.

I am a little concerned that some of the less savvy subscribers might fall for it.

Given you have received it as well, perhaps they managed to compromise the machine on some ubuntu-annouce admin and steal the mailbox details. Or looked into our email traffic and sent us this.


February 23rd, 2006, 02:36 PM
I am concerned with hedonistic spammers besmirching Ubuntu's good name, also, I am a tad concerned that their list-serv servers were compromised… especially since that damn email made it through my spam filtering…

I dunno...

Master Shake
February 23rd, 2006, 02:47 PM
The best thing to do, is to send that email, with full headers to abuse@virgilio.it and abuse@excite.com and abuse@ny.com

Or, you can bait these scammers (Check out http://www.419eater.com for info on how to do this. I used to be active in it, but I lost intrest)

February 23rd, 2006, 03:08 PM
Done. Thanks Master Shake.

Should we alert ubuntu-announce as well?

PS Susan Console?! You gotta hand it to these scammers, they have a sense of humour!

Master Shake
February 23rd, 2006, 03:25 PM
PS Susan Console?! You gotta hand it to these scammers, they have a sense of humour!

That's nothing. We've seen scams from such people as Elvis and William Shakespeare...:D

February 23rd, 2006, 03:30 PM
I still don't like the fact that they did away with the ubuntu servers...

February 24th, 2006, 04:50 AM
thats nothing. on the python mailing lists i'd get some jackass' out-of-office message at least 3 times a week, for like 5 months somehow. id take 419 scams here and there than some italian moron's contact information