A network device and method are directed towards detecting and blocking image spam within a message by performing statistical analysis on differences in edge pixel distribution patterns. An image spam detection component receives a message with an image attachment. Physical characteristics of the image are examined to determine whether the image is a candidate for further analysis. If so, then the image may be converted to a grayscale image, and then performing edge detection, followed by the elimination of non-maxima and thresholding of weak edges. Edge pixels and then employed to determine a normalized pixel density distribution (PDD). Various statistical analyses are applied to the resulting normalized PDD to determine a likelihood that the image is spam. A signature based exemption may be applied to images improperly identified as spam, based on trusted user feedback.