1. A method comprising: receiving, at a computer system, a plurality of spam email messages; for at least one received spam email message having a size less than a threshold: the computer system finding a feature in the spam email message; the computer system repeatedly adding the feature to the spam email message until its size reaches the threshold; the computer system subsequently performing comparisons involving the spam email messages to identify similar spam email messages; the computer system creating a first group of spam email messages and a second group of spam email messages, wherein messages in the first group are similar to one another and pertain to a first type of spam attack, and wherein messages in the second groups are similar to one another and pertain to a second type of spam attack distinct from the first type of spam attack; the computer system creating a filter for one or more of the first and second groups; and the computer system distributing the created filters to a plurality of client computer systems for detection of spam email messages.