MainSleaze

Sugardaddie.com, a dating web site that describes its target market as “successful, attractive, ambitious, confident and experienced” people, is sending bulk email advertisements to an email address that was closed in 2002, ten years ago. The ESP is Pure 360, aka PureSender, which has a poor reputation with the Web-O-Trust but has not been sending any great volumes of spam to my spamtraps.

Judging from the age of the Sugardaddie.com domain, the spamtrap email address was closed at about the same time that this domain was registered. That would have been months or perhaps a year or more before the Sugardaddie.com web site first opened. Sugardaddie.com only started spamming this email address last week. Normally I would draw no conclusions from a single spam to a spamtrap that was or might have been a real email address at one time. This spamtrap is unlikely to have been created by a simple typo in a web form, however, and is also too old to have been legitimately subscribed to the Sugardaddie.com service. Given these facts, I strongly suspect a purchased list.

Sending IP: 83.137.133.162

Spam Sample:

Actual Headers:

Received: from mta162.pur3.net (mta162.pur3.net [83.137.133.162])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Fri,  3 Feb 2012 12:xx:xx -0600 (CST)
DKIM-Signature: <xxx>
Received: from localhost (127.0.0.1) by mta162.pur3.net id <xxx> 
        for <xxx>; Fri, 3 Feb 2012 18:xx:xx +0000 
        (envelope-from <xxx>)
Subject: Newest Members To Join Sugardaddie.com
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
From: "Sugardaddie.com" <news@sugardaddiemail.com>
Reply-To: "Sugardaddie.com" <news@sugardaddiemail.com>
X-MailId: <xxx>
To: <xxx>
Date: Fri, 03 Feb 2012 18:xx:xx +0000
Message-ID: <<xxx>@mta162.pur3.net>

Readable Email:

From: Sugardaddie.com <news@sugardaddiemail.com>
To: <spamtrap>
Subject: Newest Members To Join Sugardaddie.com
Reply-To: Sugardaddie.com <news@sugardaddiemail.com>

Hello <xxx>,

We thought you would like to know when new members join Sugardaddie.com

<removed>

We are contacting you as someone who has registered with our site as a member.
If you no longer wish to be contacted from our site, <a href=”http://sugardaddiemail.com/_act/link.php?<xxx>>Click Here</a>.