A system includes at least one router for routing email messages from a sender node to a destination node; a system memory; a network interface; a database; and a processor configured for: extracting the delivery path information from the email message; determining a network path for the email message using delivery path information; comparing the delivery path information with the plurality of prior delivery paths; determining a measure of similarity between the network path of the received email message and one or more of the plurality of prior email paths; and determining a spam score for the email received, based on the measure of similarity.