1. A method for classifying messages, the method comprising: receiving an indication sent by a user over a communication network that an electronic message is spam; executing instructions stored in memory, wherein execution of the instructions by a processor: identifies one or more distinguishing features, wherein the identified distinguishing features include numerical URLs where domain names are hidden, generates a plurality of signatures, each signature based on one or more distinguishing features of the electronic message, compares the signatures to a list of known domains, wherein matching signatures are excluded, and compares the remaining signatures for forbidden characters, wherein signature with forbidden characters are excluded; and storing the remaining signatures in memory for comparison to subsequent electronic messages.