Identification of spam honeypot domains is performed automatically by a system 1. The system 1 searches sources of Internet domains based on user input to identify Internet domains which are candidates for acting as a honeypot domain. The list 7 of domains is refined by a determination unit 8 to exclude domains which are unlikely to be useful. A domain indexer 13 ranks the domains on the basis of a plurality of criteria which are indicative of the likelihood of a domain receiving spam communications