A method and system for creating bulk filters are described. In one embodiment, the method includes receiving probe email messages indicative of spam, grouping similar probe email messages, and creating a bulk filter for each group having at least a predefined number of probe email messages without human interaction. The method further includes distributing the resulting bulk filters to clients for detection of bulk email messages at the clients.