What is snowshoe spam?

Snowshoe spam distributes sending across many IPs and domains to avoid detection. Like snowshoes distributing weight, the technique spreads volume so no single source triggers rate limits or reputation thresholds.

Characteristics: low volume per IP (under detection thresholds), many disposable domains, rapid infrastructure rotation, and similar content across sources. The pattern itself becomes detectable even when individual sources aren't flagged.

Defense requires pattern recognition across sources rather than per-source reputation. Snowshoe detection analyzes content fingerprints, domain registration patterns, and coordinated sending behavior. Blocklists specifically target snowshoe networks.