A network device and method are directed towards detecting and blocking spam within a message by rapidly performing a predication analysis based on early received sender reputation reports. Reputation reports may be received from a plurality of users receiving messages that they interpret as either spam or non-spam. A reputation report rate prediction table is employed to predict the total number of user reports that will occur. The total number of spam reports and not spam (ham) reports for may then be used with a sender categorization model to rapidly predict whether the sender is likely to be a spammer. If the sender is determined to be a spammer, various preventative actions may be taken, including, but not limited to blocking messages from the sender to users, alerting third party filter generators of the spammer, or the like.