A crowd-sourced mobile messaging spam detection and defense system includes an application running on a mobile device. The application uses an unwanted message detection algorithm to analyze and classify messages as potential unwanted messages. The potential unwanted messages are presented to a user for confirmation that the messages are unwanted messages. In response to confirmation, the mobile device transmits a notification to a virtual machine associated with the user. The virtual machine uses the notification to update the unwanted message detection algorithm which may then be transmitted to the mobile device. The virtual machine may also transmit the notification to a global virtual machine. The global virtual machine may use the notification to update a set of classification rules maintained by the global virtual machine and transmit the set of classification rules as necessary to the multiple virtual machines for use in updating the unwanted message detection algorithm.