1. A method for identifying content in electronic messages, the method comprising: storing a plurality of thumbprints in a database in memory, wherein each of the plurality of thumbprints is associated with messages identified as spam; receiving an electronic message sent over a communication network; and executing instructions stored in memory, wherein execution of the instructions by a processor: detects content in the received electronic message, identifies metadata including a numerical signature characterizing a plurality of aspects of the content, generates a plurality of variations for the numerical signature, matches at least one variation to one of the thumbprints stored in the database as being associated with spam, and classifies the received electronic message as spam based on the match.