Due to Internet, people prefer using emails instead of traditional post mails, because of its simple and easy to use. Meanwhile unsolicited emails (spam) become a serious problem, as sending bulk emails are almost cost free in terms of time and money. Spam not only reduces system performance of mail servers but also annoys mail receivers. Nowadays attacks from Internet usually have strong links with embedding malicious codes/links in spam mails. In this research study, we collected a large number of spam to observe and analyze spam sending behavior. For each spam, we gathered source IPs, the URLs in the spam, and web pages of the URL. Basing on the collected spam, we studied the spam sending behavior.