A cloud based mobile internet protocol messaging spam defense. Short message service (SMS) messages are analyzed by a cloud based virtual machine to determine if should be considered potentially unwanted messages (e.g., spam). The cloud based virtual machine uses a user specific algorithm for determining if a message should be considered to be a potentially unwanted message. Messages that are determined to be potentially unwanted messages trigger a notification to be sent to a user device associated with the virtual machine. The notification requests confirmation from the user that the potentially unwanted message is an unwanted message. The user's response to a request for confirmation is then used to update an unwanted message database associated with the user and the user device.