1. A method for classifying messages, the method comprising: receiving an electronic message over a communication network; and executing instructions stored in memory, wherein execution of the instructions by a processor: scans the received electronic message to identify candidate sections that include top-level domains, identifies one or more top-level domain names in each candidate section, determines whether to include or exclude each domain name as a distinguishing feature based on detected presence of required characters and detected presence of forbidden characters, wherein the received electronic message is associated with a set of distinguishing features, and generates a signature based on the set of distinguishing features; and storing the generated signature in memory for comparison to subsequent electronic messages.