A method for generating heuristic rules for identifying spam emails, the method comprising: collecting, by a data processor, statistical data obtained from headers of a plurality of emails, wherein the statistical data are transformed into anonymous form; analyzing, by the data processor, the collected statistical data to identify different types of content of said emails, including one or more of the headers or hyperlinks from the plurality of emails; grouping, by the data processor, the plurality of emails into one or more clusters based on the different types of content identified in said emails, wherein at least one cluster includes one or more groups of the fields in the headers of said emails; selecting, by a hash generator, at least one most frequent combination of groups of data in each cluster; generating, by the hash generator, a hash from the at least one most frequent combination of groups; formulating, by a regular expressions generator, at least one regular expression based on an analysis of hyperlinks of the emails corresponding to the generated hashes; and generating, by a heuristic rules generator, at least one heuristic rule for identifying spam emails by combining at least one hash and the corresponding regular expression, wherein at least one hash is from sequences of fields in the headers of said emails, wherein the most frequent combination of groups is identified based on at least one of: a threshold established for a number of emails analyzed for the obtaining of the statistical data, or exceeding or reaching a threshold for bringing together a predetermined percentage of the emails from which the statistical data is obtained. collecting, by a data processor, statistical data obtained from headers of a plurality of emails, wherein the statistical data are transformed into anonymous form; analyzing, by the data processor, the collected statistical data to identify different types of content of said emails, including one or more of the headers or hyperlinks from the plurality of emails; grouping, by the data processor, the plurality of emails into one or more clusters based on the different types of content identified in said emails, wherein at least one cluster includes one or more groups of the fields in the headers of said emails; selecting, by a hash generator, at least one most frequent combination of groups of data in each cluster; generating, by the hash generator, a hash from the at least one most frequent combination of groups; formulating, by a regular expressions generator, at least one regular expression based on an analysis of hyperlinks of the emails corresponding to the generated hashes; and generating, by a heuristic rules generator, at least one heuristic rule for identifying spam emails by combining at least one hash and the corresponding regular expression, wherein at least one hash is from sequences of fields in the headers of said emails, wherein the most frequent combination of groups is identified based on at least one of: a threshold established for a number of emails analyzed for the obtaining of the statistical data, or exceeding or reaching a threshold for bringing together a predetermined percentage of the emails from which the statistical data is obtained.