In some embodiments, image spam is identified by comparing color histograms of suspected spam images with color histograms of reference (known) images. The histogram comparison includes comparing a first color content in a query image with a range of similar color contents in the reference image. For example, a pixel count for a given color in the query image may be compared to pixel counts for a range of similar colors in the reference image. A histogram distance between two images may be determined according to a computed pixel count difference between the given query histogram color and a selected color in the range of similar reference histogram colors.