1. A method for determining whether an IP address is part of a bot-network comprising: determining an IP-address-aggregate associated with the IP-address; associating the IP-address-aggregate with one of a plurality of IP-address-aggregate-categories based on SMTP traffic characteristics of the IP-address-aggregate and SMTP traffic characteristics of the IP-address-aggregate-category; and assigning bot-likelihood score of the IP-address-aggregate-category to the IP-address-aggregate.