1. A computer-implemented method for detecting webpages belonging to spam campaigns, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, at a backend anti-spam server from a client-side anti-spam service, a web address of a suspicious webpage that potentially hosts a spam message; performing, by the backend anti-spam server, an initial analysis step on the web address of the suspicious webpage by determining that the web address of the suspicious webpage does not match any spam web addresses already stored in a spam database; in response to determining that the web address of the suspicious webpage does not match any of the spam web addresses already stored in the spam database, using a processor of the backend anti-spam server to: capture an image of the suspicious webpage; and normalize the image of the suspicious webpage by scaling the image to a specified resolution; comparing, by the backend anti-spam server, the image of the suspicious webpage to at least one spam image from the spam database by calculating a distance between the image of the suspicious webpage and the spam image, the spam image being associated with a spam campaign in the spam database; determining, by the backend anti-spam server, whether the web address of the suspicious webpage is associated with the spam campaign by determining whether the distance between the image of the suspicious webpage and the spam image is below a difference threshold; and in response to the determination of whether the web address of the suspicious webpage is associated with the spam campaign, updating, by the backend anti-spam server, an association between the web address of the suspicious webpage and the spam campaign in the spam database.
1. A computer-implemented method for detecting webpages belonging to spam campaigns, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, at a backend anti-spam server from a client-side anti-spam service, a web address of a suspicious webpage that potentially hosts a spam message; performing, by the backend anti-spam server, an initial analysis step on the web address of the suspicious webpage by determining that the web address of the suspicious webpage does not match any spam web addresses already stored in a spam database; in response to determining that the web address of the suspicious webpage does not match any of the spam web addresses already stored in the spam database, using a processor of the backend anti-spam server to: capture an image of the suspicious webpage; and normalize the image of the suspicious webpage by scaling the image to a specified resolution; comparing, by the backend anti-spam server, the image of the suspicious webpage to at least one spam image from the spam database by calculating a distance between the image of the suspicious webpage and the spam image, the spam image being associated with a spam campaign in the spam database; determining, by the backend anti-spam server, whether the web address of the suspicious webpage is associated with the spam campaign by determining whether the distance between the image of the suspicious webpage and the spam image is below a difference threshold; and in response to the determination of whether the web address of the suspicious webpage is associated with the spam campaign, updating, by the backend anti-spam server, an association between the web address of the suspicious webpage and the spam campaign in the spam database. 10. The method of claim 1 , wherein the web address of the suspicious webpage comprises a uniform resource locator that points to the suspicious webpage.