Abstract: A server, method and computer program product for identifying online usage of honeypots by test-takers during administration of online assessments is disclosed. The server includes at least one computer processor coupled to a network interface and configured to receive a pool of test questions used for a learning assessment. The server converts each question in the pool into a watermarked question comprising a unique string of characters; creates a corresponding web beacon for each watermarked question in the pool; loads available PHP server header information; propagates each watermarked question onto at least one seed site domain to create a cluster of seed sites; and detects when a test-taker visits at least one of the seed sites during an online assessment.