Using distinguishing properties to classify messages

A method for classifying messages, the method comprising:

• receiving an electronic message over a communication network;
• and
• executing instructions stored in memory, wherein execution of the instructions by a processor:
• scans the received electronic message to identify candidate sections that include top-level domains,
• identifies one or more top-level domain names in each candidate section,
• determines whether to include or exclude each domain name as a distinguishing feature based on detected presence of required characters and detected presence of forbidden characters, wherein the received electronic message is associated with a set of distinguishing features, and
• generates a signature based on the set of distinguishing features;
• and storing the generated signature in memory for comparison to subsequent electronic messages.