1. A computer-implemented method of spammer detection, comprising: configuring at least one processor to perform the functions of: receiving, at an email server, email data related to a plurality of hosts; analyzing a plurality of features within the email data as received at the email server, the features including at least one of email contents, a sending time of the email, or an email sending behavior; computing a plurality of distances between a plurality of vectors in a three-dimensional space based on the features; determining a plurality of clusters of hosts based on the distances; using the plurality of clusters of hosts to characterize botnet activities for spammer detection, the characterizing comprising: determining that a set of botnets belongs to a set of hosts in the plurality of clusters of hosts; determining a total number of botnets that share a sending pattern; and using the sending pattern to determine a similarity of sending patterns across botnets.