Patent ID: 7904958

Claim:
A system for identifying Internet domains for use as a honeypot domain for attracting spam communications, the system comprising: a computer system; means within the computer system for accepting user input; a domain aggregator within the computer system coupled to the means for accepting user input, the domain aggregator arranged to search sources of Internet domains based on the user input to identify Internet domains which are candidates for acting as a honeypot domain and to output a list of the identified Internet domains; a determination unit within the computer system coupled to the domain aggregator and arranged to receive the list of identified Internet domains output by the domain aggregator and arranged to determine, in respect of individual Internet domains in the list, (a) whether there is a published identification of a computer system which accepts communications for the domain, and (b) whether there is a published record of the domain having an owner, arranged to refine the list of Internet domains, on the basis of the determination results to exclude domains for which either (a) there is a published identification of a computer system which accepts communications for the domain or (b) whether there is a published record of the domain having an owner, and arranged to output the refined list; wherein the determination unit is arranged to determine whether there is a published identification of a computer system which accepts communications for the domain is performed by making a DNS query requesting an MX record for the domain and determining whether an MX record is received in response, wherein if an MX record is not received in response to the DNs query, the domain is considered to be a candidate for acting as a honeypot domain, and wherein if an MX record is received in response to the DNS query, the domain is not considered to be a candidate for acting as a honeypot domain.