What is the terminology for senders hopping to new IP addresses after burning out their existing ones?

Summary

The discussion revolves around the terminology for senders rapidly changing IP addresses, often after their existing IPs have been flagged or 'burned out' due to poor sending practices. While no single, universally accepted term exists, 'snowshoeing' and 'hailstorming' are mentioned. 'Snowshoeing' generally describes spreading email volume across multiple IPs to avoid reputation damage, not necessarily the act of switching IPs after burning them out. 'Hailstorming' is suggested as a term for burning through IPs and rapidly acquiring new ones. Regardless of the specific terminology, the practice of frequently changing IPs is largely associated with spammers attempting to evade IP-based reputation systems. This tactic is generally considered a poor practice that harms deliverability and increases the risk of blacklisting by ESPs. Maintaining a good sending reputation, slowly warming up new IPs (especially dedicated IPs), and avoiding spam-like behavior are crucial for successful email delivery. Botnets are also mentioned, and relate to hiding your origin ip and sending through multiple IP addresses.

Key findings

  • Snowshoeing: Spreading email volume across multiple IPs to minimize reputation damage.
  • Hailstorming: A term suggested for burning through IPs and rapidly acquiring new ones.
  • Evasion Tactic: Frequently changing IPs is used by spammers to evade IP-based reputation systems.
  • Negative Impact: Rapid IP changes negatively impact deliverability and increase blacklisting risk.
  • Botnets: Spammers often use botnets to send from multiple IPs to hide the origin.

Key considerations

  • Sender Reputation: Focus on building and maintaining a positive sender reputation through ethical sending practices.
  • IP Warm-up: Slowly warm up new IPs, especially dedicated IPs, to establish a good sending history.
  • Blacklist Prevention: Avoid practices that can lead to blacklisting, such as sending unsolicited emails or having high complaint rates.
  • Monitor Reputation: Monitor your IP and domain reputation regularly to identify and address any issues promptly.

What email marketers say
8Marketer opinions

The terminology for senders rapidly switching IP addresses after their existing ones are 'burned out' isn't definitively established with one single term. 'Snowshoeing' refers to spreading sending volume across multiple IPs to avoid reputation damage, not necessarily burning and switching. 'Hailstorming' is suggested as a term for burning through IPs and acquiring new ones. Regardless of the specific term, rapidly changing IPs is a tactic employed by spammers to evade IP-based reputation systems and is indicative of poor sending practices that will negatively impact deliverability. Email service providers may blacklist entire IP address blocks to prevent spamming activities. A dedicated IP address requires a slow warm-up period, as sudden large sending volumes can damage IP reputation. Once an IP is blacklisted, it can be extremely difficult to get it removed and prevent blacklisting in the first place.

Key opinions

  • Snowshoeing: Refers to spreading sending volume across multiple IPs to minimize reputation damage, not burning/switching IPs.
  • Hailstorming: Suggested term for burning through IPs and acquiring new ones.
  • Evasion Tactic: Rapid IP changes are often a tactic used by spammers to evade IP reputation systems.
  • Deliverability Impact: Quickly switching IPs negatively impacts deliverability.
  • Blacklisting Risk: Rapidly changing IPs increases the risk of being blacklisted.
  • Dedicated IP: Dedicated IPs must be warmed up slowly to establish good sending reputation.

Key considerations

  • Reputation Damage: Rapidly changing IPs can severely damage your sender reputation.
  • Blacklist Removal: Getting off a blacklist is a difficult and time-consuming process.
  • Sending Practices: Instead of evading reputation systems, senders should focus on ethical and sustainable sending practices to maintain a good reputation and high deliverability.
  • IP Warmup: If using a dedicated IP, gradually increase sending volume.
Marketer view

Email marketer from MailerMailer Blog explains that frequently changing IP addresses is a tactic employed by spammers to evade IP-based reputation systems. When a sender quickly moves to a new IP after their previous one has been flagged for poor sending behavior, it suggests an attempt to sidestep accountability and maintain deliverability despite engaging in practices that negatively impact their sender reputation.

August 2023 - MailerMailer Blog
Marketer view

Email marketer from Quora User answers that a dedicated IP address is one which is used only by yourself. They also mention that if you do not send regular emails or send spam, this can damage the IP address reputation and lead to blacklisting.

March 2023 - Quora
Marketer view

Marketer from Email Geeks explains that snowshoeing isn't really hoping to new IPs after the current ones are burnt, it's more spreading volumes on many IPs, on multiple IP ranges. I don't know if there's a name for changing IPs after burning some. Other than "oh God no."

February 2025 - Email Geeks
Marketer view

Email marketer from Reddit User answers the question to say that once you are on a block list, it's incredibly difficult to get off. You need to work with the list provider to fix the reason that you were blacklisted.

September 2022 - Reddit
Marketer view

Email marketer from StackExchange User responds that this activity may constitute as spamming activity and as such Email Service Providers may have the whole blocks of IP addresses blacklisted by reputation systems to prevent the spamming from happening.

December 2023 - StackExchange
Marketer view

Marketer from Email Geeks shares that burning out new IPs and getting new ones is called = hailstorming.

August 2021 - Email Geeks
Marketer view

Marketer from Email Geeks explains that 'Snowshoeing' is the term. The idea is really more that you spread things out over a bunch of IPs in order to keep volume and rep damage down. So, it's like literal snowshoeing.

April 2021 - Email Geeks
Marketer view

Email marketer from SendPulse Blog shares that when using dedicated IP addresses, sudden spikes in sending volume can damage your sender reputation, so new dedicated IPs need to be warmed up. Spammers may try to bypass this by quickly moving to new, unused IPs to send large volumes of messages, which is a poor practice and ultimately harms deliverability.

June 2023 - SendPulse Blog

What the experts say
2Expert opinions

The terminology is related to tactics used by spammers to evade detection. 'Snowshoe spam' involves sending low volumes of email from a large number of IP addresses to make it harder to identify and block the spammer. Spammers also use botnets to send spam from multiple IP addresses, including residential IP addresses, to further obscure their origin and evade detection.

Key opinions

  • Snowshoe Spam: Sending low volumes of email from many IP addresses to evade detection.
  • Botnets: Using botnets to send spam from multiple, diverse IP addresses, including residential IPs.
  • Evasion Goal: Both techniques aim to evade detection by reputation systems and filtering algorithms.

Key considerations

  • Monitoring: Monitor your IP reputation and sending volumes to detect any potential issues.
  • Security: Ensure your systems are secure to prevent them from being used as part of a botnet.
  • Reputation Management: Proactively manage your sender reputation by following email best practices.
Expert view

Expert from Word to the Wise explains that snowshoe spam involves sending low volumes of email from a large number of IP addresses. This makes it harder to identify and block the spammer, as each IP sends only a small amount of spam. The goal is to evade detection by reputation systems and filtering algorithms.

January 2024 - Word to the Wise
Expert view

Expert from Spamresource shares that spammers often use botnets to send spam from multiple IP addresses, including residential IP addresses. This makes it harder to block the spammer, as the spam is coming from a wide range of IP addresses that are not typically associated with spam. They also explain that spammers often use botnets to hide their origin IP address to make it harder to track them down.

August 2023 - Spamresource

What the documentation says
3Technical articles

Spammers employ various tactics to evade detection and maintain deliverability despite engaging in harmful practices. 'Snowshoe Spam' involves distributing spam campaigns across many IPs and domains, sending small volumes from each IP to avoid being blocked. Rotating through different IP addresses is another method used to circumvent IP-based reputation systems. These tactics, especially rapidly changing IPs, often lead to being added to block lists, as filtering systems flag suspicious activity from quickly rotating IPs.

Key findings

  • Snowshoe Spam: Distributing spam across many IPs and domains to avoid complete blocking.
  • IP Rotation: Rotating IPs to circumvent IP-based reputation systems.
  • Blacklisting: Rapidly changing IPs increases the likelihood of being added to block lists.
  • Evasion: The end goal of these methods is spam evasion.

Key considerations

  • Reputation Monitoring: Regularly monitor IP reputation to identify potential issues and address them promptly.
  • Sending Practices: Adhere to email best practices to maintain a good sending reputation and avoid being flagged as a spammer.
  • Block List Awareness: Be aware of block list policies and take steps to avoid being added to them.
Technical article

Documentation from Microsoft indicates that rapidly changing IP addresses can lead to being added to block lists. When IP addresses are observed sending suspicious volumes of email from various, quickly rotating IPs, filtering systems are more likely to flag those IPs (and the associated domains) as sources of unwanted mail.

March 2025 - Microsoft
Technical article

Documentation from Cisco explains that spammers rotate through different IP addresses to attempt to circumvent IP-based reputation systems. They do this so they can keep spamming while making it harder to track and block them based on IP reputation.

October 2022 - Cisco
Technical article

Documentation from Spamhaus defines Snowshoe Spam as a spamming technique where spammers distribute their spam campaigns over many IPs and domains to spread out their reputation damage and avoid being completely blocked. This involves using a large number of IP addresses to send small volumes of spam from each, making it harder for filters to detect and block the spammer's activity effectively.

January 2023 - Spamhaus