What is hit-and-run spam?

Imagine a spammer who registers a fresh domain at midnight, blasts millions of emails by sunrise, and disappears before blocklists even know they existed. That's hit-and-run spam in a nutshell.

The strategy is simple: send as much as possible, as fast as possible, before reputation systems catch up. Spammers burn through a domain or IP for hours, sometimes a day or two, then abandon it entirely and spin up something new. By the time Spamhaus or another blocklist flags the infrastructure, it's already dead and the attacker has moved on.

What makes this viable is cost. Domain registrations are cheap (sometimes just a few dollars), so treating them as throwaway resources is a perfectly workable business model for a spammer. Speed matters far more than longevity. The goal isn't to build a sustainable sender reputation. The goal is to land enough emails before the window slams shut.

This is also why traditional reputation-based filtering struggles here. Those systems are designed to learn over time. Hit-and-run attacks are deliberately designed to outrun that learning curve.

Modern defenses have adapted. Real-time content analysis helps catch patterns even from unknown senders. Infrastructure fingerprinting looks at things like registrar patterns, nameserver choices, and domain age to flag suspicious new sources before they build a full track record. Coordinated blocklist intelligence sharing (where providers flag threats across networks simultaneously) has also shortened the window spammers can exploit.

If you're a legitimate sender, hit-and-run spam affects you indirectly. When shared IP neighborhoods get hammered by this kind of activity, it can drag down deliverability for everyone on that range. That's one good reason to be on a dedicated IP if your volume justifies it, or to know your ESP's reputation management practices.