11. A system for detecting webpages belonging to spam campaigns, the system comprising: an identification module, stored in memory, that receives, as part of a backend anti-spam server from a client-side anti-spam service, a web address of a suspicious webpage that potentially hosts a spam message; a determination module, stored in memory, that performs, as part of the backend anti-spam server, an initial analysis step on the web address of the suspicious webpage by determining that the web address of the suspicious webpage does not match any spam web addresses already stored in a spam database; an image module, stored in memory, that uses a processor of the backend anti-spam server to: capture an image of the suspicious webpage in response to the determination that the web address of the suspicious webpage does not match any of the spam web addresses already stored in the spam database; and normalize the image of the suspicious webpage by scaling the image to a specified resolution; a comparison module, stored in memory, that compares, as part of the backend anti-spam server, the image of the suspicious webpage to at least one spam image from the spam database by calculating a distance between the image of the suspicious webpage and the spam image, the spam image being associated with a spam campaign in the spam database; wherein the determination module further determines, as part of the backend anti-spam server, whether the web address of the suspicious webpage is associated with the spam campaign by determining whether the distance between the image of the suspicious webpage and the spam image is below a difference threshold; a database module, stored in memory, that updates, as part of the backend anti-spam server, an association between the web address of the suspicious webpage and the spam campaign in the spam database in response to the determination of whether the web address of the suspicious webpage is associated with the spam campaign; and at least one processor that executes the identification module, the image module, the comparison module, the determination module, and the database module.
11. A system for detecting webpages belonging to spam campaigns, the system comprising: an identification module, stored in memory, that receives, as part of a backend anti-spam server from a client-side anti-spam service, a web address of a suspicious webpage that potentially hosts a spam message; a determination module, stored in memory, that performs, as part of the backend anti-spam server, an initial analysis step on the web address of the suspicious webpage by determining that the web address of the suspicious webpage does not match any spam web addresses already stored in a spam database; an image module, stored in memory, that uses a processor of the backend anti-spam server to: capture an image of the suspicious webpage in response to the determination that the web address of the suspicious webpage does not match any of the spam web addresses already stored in the spam database; and normalize the image of the suspicious webpage by scaling the image to a specified resolution; a comparison module, stored in memory, that compares, as part of the backend anti-spam server, the image of the suspicious webpage to at least one spam image from the spam database by calculating a distance between the image of the suspicious webpage and the spam image, the spam image being associated with a spam campaign in the spam database; wherein the determination module further determines, as part of the backend anti-spam server, whether the web address of the suspicious webpage is associated with the spam campaign by determining whether the distance between the image of the suspicious webpage and the spam image is below a difference threshold; a database module, stored in memory, that updates, as part of the backend anti-spam server, an association between the web address of the suspicious webpage and the spam campaign in the spam database in response to the determination of whether the web address of the suspicious webpage is associated with the spam campaign; and at least one processor that executes the identification module, the image module, the comparison module, the determination module, and the database module. 13. The system of claim 11 , wherein: the determination module determines whether the distance between the image of the suspicious webpage and the spam image is below the difference threshold by determining that the distance is below the difference threshold; and the database module updates the association between the web address of the suspicious webpage and the spam campaign in the spam database by creating the association.