Identification of spam honeypot domains is performed automatically by a system. The system searches sources of Internet domains based on user input to identify Internet domains which are candidates for acting as a honeypot domain. The list of domains is refined by a determination unit to exclude domains which are unlikely to be useful. A domain indexer ranks the domains on the basis of a plurality of criteria which are indicative of the likelihood of a domain receiving spam communications.