1. A system for detecting malicious e-mails from spam zombies, the system comprising: a processor operable to process a server identification value of a sending source by separating the value into one or more domain level terms to allow each unique term to be tokenized with an index value and to apply the one or more tokenized values as a learning feature in a learning algorithm trained to identify spam zombies.