1. A computer-implemented method of spammer detection, comprising: collecting data related to a plurality of hosts at a vantage point; analyzing a plurality of features within the data, the features including at least one of email contents, a sending time of the email, or an email sending behavior; computing a plurality of distances between a plurality of vectors in a three-dimensional space based on the features; and determining a plurality of clusters of the hosts based on the distances.