MainSleaze

Today Buckaroo emailed a list of scraped or purchased email addresses advertising its services and requesting the recipients to “claim their Buckaroo Account”. The email addresses that they emailed have not been live for more than ten years, if they ever existed. It appears that Buckaroo scraped old web-based business registries or similar sources of data, or purchased a list from somebody who did. The ESP is Puresend.

I would block buckaroo.com and any IPs that have this domain in rDNS outright on my personal mailserver. Those who manage mailservers for ISPs, companies or organizations might prefer to send this email to the bulk or spam folder.

Sending IPs: 4.28.1.115 - 4.28.1.119

Spam Sample:

Actual Headers:

Received: from services#.d.buckaroo.com (unknown [4.28.1.11#])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu,  3 Jul 2014 01:##:## -0500 (CDT)
Message-ID: <<xxx>@detroit>
Date: Wed, 2 Jul 2014 23:##:## -0700
To: <xxx>
Subject: Claim Your Buckaroo Account
Reply-To: <info@i.buckaroo.com>
From: "Buckaroo" <info@i.buckaroo.com>
List-Unsubscribe: <mailto:abuse@deals.buckaroo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="<xxx>"

Readable Email:

From: Buckaroo <info@i.buckaroo.com>
To: <spamtrap>
Subject: Claim Your Buckaroo Account
List-Unsubscribe: <mailto:abuse@deals.buckaroo.com>

Claim Your Buckaroo Account

Local news, events and shopping

<removed>

Did you know you have a page on Buckaroo? Simply sign in and update your page to reach thousands of local customers. Best of all, it’s free!

Copyright =C2=A92014, Iron Speed, Inc. Buckaroo is a trademark of Iron Speed, Inc.
Iron Speed, Inc. 2870 Zanker Road, Suite 210, San Jose, CA 95134 USA
Toll Free +1 (408)791-3000
Unsubscribe <xxx> from Claim Your Buckaroo Account