Buckaroo: Emailing Scraped Email Addresses or Purchased List

Today Buckaroo emailed a list of scraped or purchased email addresses advertising its services and requesting the recipients to “claim their Buckaroo Account”. The email addresses that they emailed have not been live for more than ten years, if they ever existed. It appears that Buckaroo scraped old web-based business registries or similar sources of data, or purchased a list from somebody who did. The ESP is Puresend.

I would block buckaroo.com and any IPs that have this domain in rDNS outright on my personal mailserver. Those who manage mailservers for ISPs, companies or organizations might prefer to send this email to the bulk or spam folder.

Sending IPs: -

Spam Sample:

Actual Headers:

Received: from services#.d.buckaroo.com (unknown [])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Thu,  3 Jul 2014 01:##:## -0500 (CDT)
Message-ID: <<xxx>@detroit>
Date: Wed, 2 Jul 2014 23:##:## -0700
To: <xxx>
Subject: Claim Your Buckaroo Account
Reply-To: <info@i.buckaroo.com>
From: "Buckaroo" <info@i.buckaroo.com>
List-Unsubscribe: <mailto:abuse@deals.buckaroo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;

Readable Email:

From: Buckaroo <info@i.buckaroo.com>
To: <spamtrap>
Subject: Claim Your Buckaroo Account
List-Unsubscribe: <mailto:abuse@deals.buckaroo.com>

Claim Your Buckaroo Account

Local news, events and shopping


Did you know you have a page on Buckaroo? Simply sign in and update your page to reach thousands of local customers. Best of all, it’s free!

Copyright =C2=A92014, Iron Speed, Inc. Buckaroo is a trademark of Iron Speed, Inc.
Iron Speed, Inc. 2870 Zanker Road, Suite 210, San Jose, CA 95134 USA
Toll Free +1 (408)791-3000
Unsubscribe <xxx> from Claim Your Buckaroo Account

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Go back to top