What is the terminology for senders hopping to new IP addresses after burning out their existing ones?
Michael Ko
Co-founder & CEO, Suped
Published 1 Jul 2025
Updated 19 Aug 2025
7 min read
In the world of email deliverability, sender reputation is paramount. It determines whether your emails land in the inbox, the spam folder, or are blocked entirely. This reputation is closely tied to the IP addresses you use for sending mail. When an IP address accumulates a poor sending history, it becomes burnt, meaning it's been flagged by internet service providers (ISPs) as a source of problematic mail.
Some senders, particularly those engaged in less-than-reputable practices, attempt to circumvent these reputation issues by frequently abandoning old, compromised IP addresses and acquiring new ones. This strategy is often employed in an effort to reset their sending reputation or evade detection. While it might seem like a quick fix, it's a practice that ISPs are increasingly adept at identifying and penalizing.
The foundation of IP reputation
Every email sent from a particular IP address contributes to its reputation. Factors like spam complaints, bounce rates, spam trap hits, and engagement metrics (opens and clicks) all play a crucial role. A good reputation is built over time through consistent sending of legitimate, wanted emails. Conversely, a poor reputation is quickly earned by sending unsolicited or low-quality content.
IP warming is the standard practice for building a positive sending reputation on a new IP address. This involves gradually increasing your email volume over a period of days or weeks, allowing ISPs to observe your sending behavior and establish trust. Skipping this crucial step or mismanaging it can quickly lead to reputation damage, pushing emails into the spam folder. You can learn more about the best approach for warming up an IP address in our guides.
IP warming is essential
Proper IP warming is not just a recommendation; it is a fundamental requirement for establishing trust with mailbox providers and ensuring your emails reach their intended recipients. Without a careful warm-up strategy, even legitimate senders risk having their mail treated as spam or outright blocked.
When an IP address becomes burnt, it means that its sender reputation has fallen to a point where ISPs are actively filtering or rejecting mail from it. This can be due to high spam complaints, sending to invalid addresses, hitting spam traps, or violating email sending policies. The consequences include severe deliverability issues, leading to wasted marketing efforts and potential damage to your brand.
Snowshoeing: spreading the risk
The term snowshoeing refers to a tactic where senders spread their email volume across a large number of IP addresses, often from multiple IP ranges. The analogy comes from the idea of a snowshoe distributing weight over a wide area to prevent sinking. In email terms, this means distributing email volume to avoid accumulating a high volume of complaints or negative reputation on any single IP.
This practice is typically associated with spammers or questionable senders who aim to dilute their poor sending metrics. By sending small volumes from many different IPs, they hope to fly under the radar of ISP detection systems that primarily monitor individual IP reputation. Spamhaus, a leading anti-spam organization, defines snowshoeing as a tactic that uses a broad range of IP addresses to bypass reputation filters.
While snowshoeing might offer a temporary advantage to illicit senders, ISPs are sophisticated enough to recognize these patterns. They analyze sending behavior across entire IP ranges and autonomous system numbers (ASNs), not just individual IPs. Consequently, a large block of IPs (or a whole subnet) can be placed on a blocklist (or blacklist) if snowshoeing activity is detected, impacting all senders within that range.
Hailstorming: rapid IP hopping
The specific term for senders who hop to new IP addresses after burning out their existing ones is hailstorming. This tactic involves a rapid, almost frantic, rotation through many different IP addresses, discarding them as soon as they become tarnished. It's an aggressive and short-lived strategy employed by severe offenders, often for very high-volume, malicious spam campaigns.
Hailstorming differs from snowshoeing in its urgency and the intent behind the IP rotation. While snowshoeing aims to spread risk and maintain a low profile over a longer period, hailstorming is about maximizing immediate outreach before an IP is completely shut down. The concept of IP rotation in general can be legitimate for other online activities, but in email, when done aggressively due to poor reputation, it's a clear indicator of malicious intent.
Snowshoeing
Strategy: Distributes email volume across many IP addresses simultaneously to dilute reputation.
Purpose: Aims to avoid high complaint rates on individual IPs over a sustained period.
Duration: Often a continuous tactic to maintain low-level spamming.
Hailstorming
Strategy: Rapidly discards burnt IPs and acquires new ones to send high volumes quickly.
Purpose: Maximizes immediate outreach for short-term, often malicious, campaigns.
Duration: Very short-lived, as new IPs quickly get blocked.
This practice is often coupled with domain hopping as well, where senders register new domains to bypass domain-based reputation filters. Both snowshoeing and hailstorming are clear indicators of bad sending practices and are quickly identified by sophisticated anti-spam systems.
Impact and detection by ISPs
ISPs and blocklist (or blacklist) operators are well aware of these evasive tactics. They employ advanced algorithms and data analysis to detect patterns of suspicious sending behavior, regardless of how many IP addresses are being used. This includes monitoring:
Volume and frequency: Unusually high sending volumes from new or rapidly changing IP addresses.
Complaint rates: Consistent high complaint rates across a series of different IPs.
Spam trap hits: Connections to multiple spam traps across different IP addresses, indicating a non-opt-in list.
Content analysis: Similar malicious or low-quality content being sent from various IPs and domains.
When such patterns are identified, the consequences for the sender are severe. Not only will the new IP addresses quickly get blocked (or blacklisted), but the associated domains may also suffer reputation damage. In extreme cases, the sending organization itself could face scrutiny, leading to widespread deliverability failures for all its email campaigns, regardless of the IP used. This highlights the importance of blocklist monitoring to stay informed.
ISPs prioritize protecting their users from unwanted mail. They invest heavily in sophisticated systems to identify and mitigate abusive sending practices. Tactics like snowshoeing and hailstorming are quickly identified and can lead to immediate and prolonged email blocking, making it nearly impossible for the sender to reach the inbox. Continuous monitoring of your domain reputation is critical.
Views from the trenches
Best practices
Maintain meticulous list hygiene to avoid spam traps and reduce bounce rates, which are key drivers of IP reputation decline.
Implement strong authentication protocols like SPF, DKIM, and DMARC to prove legitimate sending and build trust.
Segment your audience and tailor content to ensure high engagement, reducing complaints and improving sender scores.
Regularly monitor your email deliverability metrics, including inbox placement, complaint rates, and bounce rates.
Actively manage unsubscriptions and promptly remove non-engaging subscribers to keep your lists healthy and responsive.
Common pitfalls
Ignoring early warning signs of declining IP reputation, leading to a complete burnout before corrective action is taken.
Acquiring email lists from third-party sources without proper opt-in consent, resulting in high spam complaints.
Failing to warm up new IP addresses properly, causing immediate reputation issues and poor inbox placement.
Sending inconsistent email volumes, which can confuse ISPs and trigger spam filters, regardless of content quality.
Over-relying on shared IP addresses for high-volume or sensitive sends, losing control over your own sending reputation.
Expert tips
Focus on building a strong, long-term sender reputation through consistent, wanted mail.
Prioritize email list hygiene and consent-based practices to ensure high engagement and low complaints.
Regularly monitor your IP reputation and adjust sending practices proactively.
If using dedicated IPs, implement a robust IP warming strategy.
Engage with your audience to foster positive interactions, which is the best defense against reputation issues.
Expert view
Expert from Email Geeks says snowshoeing isn't simply hopping to new IPs after existing ones are burnt. It's about spreading email volumes across many IPs and multiple IP ranges from the start to manage reputation.
2020-01-15 - Email Geeks
Marketer view
Marketer from Email Geeks says the term 'hailstorming' accurately describes the aggressive practice of burning out new IPs and then acquiring even more new ones.
2020-01-14 - Email Geeks
Building a sustainable sending reputation
For legitimate senders, building and maintaining a strong sender reputation is a continuous process that relies on transparency, compliance, and consistent good sending practices. There are no shortcuts or quick fixes when it comes to deliverability.
Attempting to evade reputation issues by constantly changing IP addresses, whether through snowshoeing or hailstorming, is a short-sighted and ultimately ineffective strategy. ISPs are constantly evolving their detection mechanisms to catch such behaviors, leading to eventual blocking and severe damage to your ability to communicate with your audience.
Instead, focus on the fundamentals: building an engaged list, sending relevant content, adhering to email authentication standards like DMARC, and monitoring your sender metrics diligently. These are the true paths to long-term email deliverability success.
