A spam detection system, which comprises: a mail server which comprises: - one or more "legitimate or malicious" address lists, each address list categorizes originating addresses of emails as either legitimate or malicious; - a Content Based Filter and analyzer for content analyzing each incoming email based on its content, for forwarding to respective addressees only emails that pass said analysis, and for further updating said "legitimate or malicious" address lists based on the results of said content analysis; and - means for producing an email log and for conveying the same to a Historical Data Set, HDS, analyzing un it; a HDS analyzing unit for: i. receiving said email log from said mail server; ii. converting said email log to a plurality of windows durations of Historical Data Sets, said windows divide the past history into exponentially increased periods, respectively, wherein features data relating to newest emails are stored in shorter period windows, and features data relating to older emails are stored in longer period windows; iii. for each originating address in said emails log, analyzing said windows of the Historical Data Sets, and determining whether said originating address introduces a potential danger to the computer system of the respective email addressee; and iv. conveying a summary of said Historical Data Sets analysis to said email server, for optionally updating said "legitimate or malicious" lists. a mail server which comprises: - one or more "legitimate or malicious" address lists, each address list categorizes originating addresses of emails as either legitimate or malicious; - a Content Based Filter and analyzer for content analyzing each incoming email based on its content, for forwarding to respective addressees only emails that pass said analysis, and for further updating said "legitimate or malicious" address lists based on the results of said content analysis; and - means for producing an email log and for conveying the same to a Historical Data Set, HDS, analyzing un it; - one or more "legitimate or malicious" address lists, each address list categorizes originating addresses of emails as either legitimate or malicious; - a Content Based Filter and analyzer for content analyzing each incoming email based on its content, for forwarding to respective addressees only emails that pass said analysis, and for further updating said "legitimate or malicious" address lists based on the results of said content analysis; and - means for producing an email log and for conveying the same to a Historical Data Set, HDS, analyzing un it; a HDS analyzing unit for: i. receiving said email log from said mail server; ii. converting said email log to a plurality of windows durations of Historical Data Sets, said windows divide the past history into exponentially increased periods, respectively, wherein features data relating to newest emails are stored in shorter period windows, and features data relating to older emails are stored in longer period windows; iii. for each originating address in said emails log, analyzing said windows of the Historical Data Sets, and determining whether said originating address introduces a potential danger to the computer system of the respective email addressee; and iv. conveying a summary of said Historical Data Sets analysis to said email server, for optionally updating said "legitimate or malicious" lists. i. receiving said email log from said mail server; ii. converting said email log to a plurality of windows durations of Historical Data Sets, said windows divide the past history into exponentially increased periods, respectively, wherein features data relating to newest emails are stored in shorter period windows, and features data relating to older emails are stored in longer period windows; iii. for each originating address in said emails log, analyzing said windows of the Historical Data Sets, and determining whether said originating address introduces a potential danger to the computer system of the respective email addressee; and iv. conveying a summary of said Historical Data Sets analysis to said email server, for optionally updating said "legitimate or malicious" lists.