A computer for augmenting a message to facilitate spam identification, comprising: a processor; and a memory connected to the processor, the memory storing instructions executed by the processor to: receive a message; augment the message by the message augmentation module with network node attributes derived from original network node information wherein the network node information includes a starting set of Internet Protocol addresses and hostnames from any location within the message; identify additional Internet Protocol addresses and hostnames related to the starting set of Internet Protocol addresses and hostnames; form a relationship graph characterizing the network node attributes by linking from an original network node (300, 306, 308, 310) specified in the message to additional network nodes associated with the original network node to establish a graph of relationships from the original network node to the additional network nodes; define an overlay network of nodes having spam characteristics using the graph of relationships between the hostnames and the Internet Protocol addresses; decide whether to further augment the message with additional network node attributes through recursive linking;generate by a message classifier message signatures representing the network node attributes, and evaluate the message signatures to characterize the message as an unsolicited bulk electronic message i.e. spam, by comparing the message signatures to message signatures that are known to be associated with spam. a processor; and a memory connected to the processor, the memory storing instructions executed by the processor to: receive a message; augment the message by the message augmentation module with network node attributes derived from original network node information wherein the network node information includes a starting set of Internet Protocol addresses and hostnames from any location within the message; identify additional Internet Protocol addresses and hostnames related to the starting set of Internet Protocol addresses and hostnames; form a relationship graph characterizing the network node attributes by linking from an original network node (300, 306, 308, 310) specified in the message to additional network nodes associated with the original network node to establish a graph of relationships from the original network node to the additional network nodes; define an overlay network of nodes having spam characteristics using the graph of relationships between the hostnames and the Internet Protocol addresses; decide whether to further augment the message with additional network node attributes through recursive linking;generate by a message classifier message signatures representing the network node attributes, and evaluate the message signatures to characterize the message as an unsolicited bulk electronic message i.e. spam, by comparing the message signatures to message signatures that are known to be associated with spam. receive a message; augment the message by the message augmentation module with network node attributes derived from original network node information wherein the network node information includes a starting set of Internet Protocol addresses and hostnames from any location within the message; identify additional Internet Protocol addresses and hostnames related to the starting set of Internet Protocol addresses and hostnames; form a relationship graph characterizing the network node attributes by linking from an original network node (300, 306, 308, 310) specified in the message to additional network nodes associated with the original network node to establish a graph of relationships from the original network node to the additional network nodes; define an overlay network of nodes having spam characteristics using the graph of relationships between the hostnames and the Internet Protocol addresses; decide whether to further augment the message with additional network node attributes through recursive linking;generate by a message classifier message signatures representing the network node attributes, and evaluate the message signatures to characterize the message as an unsolicited bulk electronic message i.e. spam, by comparing the message signatures to message signatures that are known to be associated with spam.