Snowshoe spam
Unsolicited bulk email spread across many IP addresses and domains, each sending a small volume, so no single address draws enough attention to be filtered.
What it means
Cisco's security blog defines snowshoe spam as unsolicited bulk email sent using a large number of IP addresses at a low message volume per address, named after snowshoes, which spread a walker's weight over a wide surface.
Spamhaus targets the pattern directly: its CSS FAQ lists snowshoe spam among the problems its Combined Spam Sources rules look for. M3AAWG's position on cold email describes a related set of tactics (lookalike domains, multiple sending accounts and random sending intervals, used to avoid spam filter detection) and calls them deceptive.
Spreading legitimate mail over many new domains and IPs to stay under limits can look the same to filters, which judge the pattern rather than the intent.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- Cisco Blogs: Walking in a winter wonderland (snowshoe spam)blogs.cisco.com
- Spamhaus FAQ: Combined Spam Sources (CSS)spamhaus.org
- M3AAWG Position on Cold Email (November 2025)m3aawg.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes