Modern Honey Network Machinations with R, Python, phantomjs, HTML & JavaScript

August 23, 2015
By

(This article was first published on Data Driven Security, and kindly contributed to R-bloggers)

This was (initially) going to be a blog post announcing the new mhn R package (more on what that is in a bit) but somewhere along the way we ended up taking a left turn at Albuquerque (as we often do here at ddsec hq) and had an adventure in a twisty maze of Modern Honey Network passages that we thought we’d relate to everyone.

Episode 0 : The Quest!

We find our intrepid heroes data scientists finally getting around to playing with the Modern Honey Network (MHN) software that they promised Jason Trost they’d do ages ago. MHN makes it easy to [freely] centrally setup, control, monitor and collect data from one or more honeypots. Once you have this data you can generate threat indicator feeds from it and also do analysis on it (which is what we’re interested in eventually doing and what ThreatStream does do with their global network of MHN contributors).

Jason has a Vagrant quickstart version of MHN which lets you kick the tyres locally, safely and securely before venturing out into the enterprise (or internet). You stand up the server (mostly Python-y things), then tell it what type of honeypot you want to deploy. You get a handy cut-and-paste-able string which you paste-and-execute on a system that will become an actual honeypot (which can be a “real” box, a VM or even a RaspberryPi!). When the honeypot is finished installing the necessary components it registers with your MHN server and you’re ready to start catching cyber bad guys.


(cyber bad guy)

Episode 1 : Live! R! Package!

We decided to deploy a test MHN server and series of honeypots on Digital Ocean since they work OK on the smallest droplet size (not recommended for a production MHN setup).

While it’s great to peruse the incoming attacks:

we wanted programmatic access to the data, so we took a look at all the routes in their API and threw together an R package to let us work with it.

library(mhn)

attacks <- sessions(hours_ago=24)$data
tail(attacks)

##                           _id destination_ip destination_port honeypot
## 3325 55d93cb8b5b9843e9bb34c75 111.222.33.111               22      p0f
## 3326 55d93cb8b5b9843e9bb34c74 111.222.33.111               22      p0f
## 3327 55d93d30b5b9843e9bb34c77 111.222.33.111               22      p0f
## 3328 55d93da9b5b9843e9bb34c79           <NA>             6379  dionaea
## 3329 55d93f1db5b9843e9bb34c7b           <NA>             9200  dionaea
## 3330 55d94062b5b9843e9bb34c7d           <NA>               23  dionaea
##                                identifier protocol       source_ip source_port
## 3325 bf7a3c5e-48e7-11e5-9fcf-040166a73101     pcap    45.114.11.23       58621
## 3326 bf7a3c5e-48e7-11e5-9fcf-040166a73101     pcap    45.114.11.23       58621
## 3327 bf7a3c5e-48e7-11e5-9fcf-040166a73101     pcap    93.174.95.81       44784
## 3328 83e2f4e0-4876-11e5-9fcf-040166a73101     pcap 184.105.139.108       43000
## 3329 83e2f4e0-4876-11e5-9fcf-040166a73101     pcap  222.186.34.160        6000
## 3330 83e2f4e0-4876-11e5-9fcf-040166a73101     pcap   113.89.184.24       44028
##                       timestamp
## 3325 2015-08-23T03:23:34.671000
## 3326 2015-08-23T03:23:34.681000
## 3327 2015-08-23T03:25:33.975000
## 3328 2015-08-23T03:27:36.810000
## 3329 2015-08-23T03:33:48.665000
## 3330 2015-08-23T03:39:13.899000

NOTE: that’s not the real destination_ip so don’t go poking since it’s probably someone else’s real system (if it’s even up).

You can also get details about the attackers (this is just one example):

attacker_stats("45.114.11.23")$data

## $count
## [1] 1861
## 
## $first_seen
## [1] "2015-08-22T16:43:59.654000"
## 
## $honeypots
## [1] "p0f"
## 
## $last_seen
## [1] "2015-08-23T03:23:34.681000"
## 
## $num_sensors
## [1] 1
## 
## $ports
## [1] 22

The package makes it really easy (OK, we’re probably a bit biased) to grab giant chunks of time series and associated metadata for further analysis.

While cranking out the API package we noticed that there were no endpoints for the MHN HoneyMap. Yes, they do the “attacks on a map” thing but don’t think too badly of them since most of you seem to want them.

After poking around the MHN source a bit more (and navigating the view-source of the map page) we discovered that they use a Go-based websocket server to push the honeypot hits out to the map. (You can probably see where this is going, but it takes that turn first).

Episode 2 : Hacking the Anti-Hackers

The other thing we noticed is that—unlike the MHN-server proper—the websocket component does not require authentication. Now, to be fair, it’s also not really spitting out seekrit data, just (pretty useless) geocoded attack source/dest and type of honeypot involved.

Still, this got us wondering if we could find other MHN servers out there in the cold, dark internet. So, we fired up RStudio again and took a look using the shodan package:

library(shodan)

# the most obvious way to look for MHN servers is to 
# scour port 3000 looking for content that is HTML
# then look for "HoneyMap" in the </span>

<span class="c1"># See how many (if any) there are</span>
host_count<span class="p">(</span><span class="s">'port:3000 title:HoneyMap'</span><span class="p">)</span><span class="o">$</span>total
<span class="c1">## [1] 141</span>

<span class="c1"># Grab the first 100</span>
hm_1 <span class="o"><-</span> shodan_search<span class="p">(</span><span class="s">'port:3000 title:HoneyMap'</span><span class="p">)</span>

<span class="c1"># Grab the last 41</span>
hm_2 <span class="o"><-</span> shodan_search<span class="p">(</span><span class="s">'port:3000 title:HoneyMap'</span><span class="p">,</span> page<span class="o">=</span><span class="m">2</span><span class="p">)</span>

head<span class="p">(</span>hm_1<span class="p">)</span>

<span class="c1">##                                           hostnames    title</span>
<span class="c1">## 1                                                   HoneyMap</span>
<span class="c1">## 2                                  hb.c2hosting.com HoneyMap</span>
<span class="c1">## 3                                                   HoneyMap</span>
<span class="c1">## 4                                          fxxx.you HoneyMap</span>
<span class="c1">## 5            ip-192-169-234-171.ip.secureserver.net HoneyMap</span>
<span class="c1">## 6 ec2-54-148-80-241.us-west-2.compute.amazonaws.com HoneyMap</span>
<span class="c1">##                    timestamp                isp transport</span>
<span class="c1">## 1 2015-08-22T17:14:25.173291               <<span class="caps">NA</span>>       tcp</span>
<span class="c1">## 2 2015-08-22T17:00:12.872171 Hosting Consulting       tcp</span>
<span class="c1">## 3 2015-08-22T16:49:40.392523      Digital Ocean       tcp</span>
<span class="c1">## 4 2015-08-22T15:27:29.661104      <span class="caps">KW</span> Datacenter       tcp</span>
<span class="c1">## 5 2015-08-22T14:01:21.014893   GoDaddy.com, <span class="caps">LLC</span>       tcp</span>
<span class="c1">## 6 2015-08-22T12:01:52.207879             Amazon       tcp</span>
<span class="c1">##                                                                                                                                                                                                       data</span>
<span class="c1">## 1 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 2278rnContent-Type: text/html; charset=utf-8rnLast-Modified: Sun, 02 Nov 2014 21:16:17 <span class="caps">GMT</span>rnDate: Sat, 22 Aug 2015 17:14:22 <span class="caps">GMT</span>rnrn</span>
<span class="c1">## 2 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 2278rnContent-Type: text/html; charset=utf-8rnLast-Modified: Wed, 12 Nov 2014 18:52:21 <span class="caps">GMT</span>rnDate: Sat, 22 Aug 2015 17:01:25 <span class="caps">GMT</span>rnrn</span>
<span class="c1">## 3 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 2278rnContent-Type: text/html; charset=utf-8rnLast-Modified: Mon, 04 Aug 2014 18:07:00 <span class="caps">GMT</span>rnDate: Sat, 22 Aug 2015 16:49:38 <span class="caps">GMT</span>rnrn</span>
<span class="c1">## 4 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 2278rnContent-Type: text/html; charset=utf-8rnDate: Sat, 22 Aug 2015 15:22:23 <span class="caps">GMT</span>rnLast-Modified: Sun, 27 Jul 2014 01:04:41 <span class="caps">GMT</span>rnrn</span>
<span class="c1">## 5 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 2278rnContent-Type: text/html; charset=utf-8rnLast-Modified: Wed, 29 Oct 2014 17:12:22 <span class="caps">GMT</span>rnDate: Sat, 22 Aug 2015 14:01:20 <span class="caps">GMT</span>rnrn</span>
<span class="c1">## 6 <span class="caps">HTTP</span>/1.1 200 <span class="caps">OK</span>rnAccept-Ranges: bytesrnContent-Length: 1572rnContent-Type: text/html; charset=utf-8rnDate: Sat, 22 Aug 2015 12:06:15 <span class="caps">GMT</span>rnLast-Modified: Mon, 08 Dec 2014 21:25:26 <span class="caps">GMT</span>rnrn</span>
<span class="c1">##   port location.city location.region_code location.area_code location.longitude</span>
<span class="c1">## 1 3000          <<span class="caps">NA</span>>                 <<span class="caps">NA</span>>                 <span class="caps">NA</span>                 <span class="caps">NA</span></span>
<span class="c1">## 2 3000   Miami Beach                   <span class="caps">FL</span>                305           -80.1300</span>
<span class="c1">## 3 3000 San Francisco                   <span class="caps">CA</span>                415          -122.3826</span>
<span class="c1">## 4 3000     Kitchener                   <span class="caps">ON</span>                 <span class="caps">NA</span>           -80.4800</span>
<span class="c1">## 5 3000    Scottsdale                   <span class="caps">AZ</span>                480          -111.8906</span>
<span class="c1">## 6 3000      Boardman                   <span class="caps">OR</span>                541          -119.5290</span>
<span class="c1">##   location.country_code3 location.latitude location.postal_code location.dma_code</span>
<span class="c1">## 1                   <<span class="caps">NA</span>>                <span class="caps">NA</span>                 <<span class="caps">NA</span>>                <span class="caps">NA</span></span>
<span class="c1">## 2                    <span class="caps">USA</span>           25.7906                33109               528</span>
<span class="c1">## 3                    <span class="caps">USA</span>           37.7312                94124               807</span>
<span class="c1">## 4                    <span class="caps">CAN</span>           43.4236                  <span class="caps">N2E</span>                <span class="caps">NA</span></span>
<span class="c1">## 5                    <span class="caps">USA</span>           33.6119                85260               753</span>
<span class="c1">## 6                    <span class="caps">USA</span>           45.7788                97818               810</span>
<span class="c1">##   location.country_code location.country_name                           ipv6</span>
<span class="c1">## 1                  <<span class="caps">NA</span>>                  <<span class="caps">NA</span>> 2600:3c02::f03c:91ff:fe73:4d8b</span>
<span class="c1">## 2                    <span class="caps">US</span>         United States                           <<span class="caps">NA</span>></span>
<span class="c1">## 3                    <span class="caps">US</span>         United States                           <<span class="caps">NA</span>></span>
<span class="c1">## 4                    <span class="caps">CA</span>                Canada                           <<span class="caps">NA</span>></span>
<span class="c1">## 5                    <span class="caps">US</span>         United States                           <<span class="caps">NA</span>></span>
<span class="c1">## 6                    <span class="caps">US</span>         United States                           <<span class="caps">NA</span>></span>
<span class="c1">##            domains                org   os module                         ip_str</span>
<span class="c1">## 1                                <<span class="caps">NA</span>> <<span class="caps">NA</span>>   http 2600:3c02::f03c:91ff:fe73:4d8b</span>
<span class="c1">## 2    c2hosting.com Hosting Consulting <<span class="caps">NA</span>>   http                  199.88.60.245</span>
<span class="c1">## 3                       Digital Ocean <<span class="caps">NA</span>>   http                104.131.142.171</span>
<span class="c1">## 4         fxxx.you      <span class="caps">KW</span> Datacenter <<span class="caps">NA</span>>   http                  162.244.29.65</span>
<span class="c1">## 5 secureserver.net   GoDaddy.com, <span class="caps">LLC</span> <<span class="caps">NA</span>>   http                192.169.234.171</span>
<span class="c1">## 6    amazonaws.com             Amazon <<span class="caps">NA</span>>   http                  54.148.80.241</span>
<span class="c1">##           ip     asn link uptime</span>
<span class="c1">## 1         <span class="caps">NA</span>    <<span class="caps">NA</span>> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
<span class="c1">## 2 3344448757 <span class="caps">AS40539</span> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
<span class="c1">## 3 1753452203    <<span class="caps">NA</span>> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
<span class="c1">## 4 2733907265    <<span class="caps">NA</span>> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
<span class="c1">## 5 3232361131 <span class="caps">AS26496</span> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
<span class="c1">## 6  915689713    <<span class="caps">NA</span>> <<span class="caps">NA</span>>     <span class="caps">NA</span></span>
</pre>
</div>
<p>Yikes! 141 servers just on the default port (3000) alone! While these systems may be shown as existing in Shodan, we really needed to confirm that they were, indeed, live <span class="caps">MHN</span> HoneyMap [websocket] servers. </p>
<h3 id="episode-3-picture-imperfect">Episode 3 : Picture [Im]Perfect</h3>
<p>Rather than just test for existence of the websocket/data feed we decided to take a screen shot of every server, which is pretty easy to do with a crude-but-effective mashup of R and <code>phantomjs</code>. For this, we made a script which is just a call—for each of the websocket URLs—to the “built-in” phantomjs <a href="https://gist.github.com/hrbrmstr/6b119648739cd275a69e#file-ourrasterize-js-L45" rel="nofollow" target="_blank">rasterize.js script</a> that we’ve slightly modified to wait 30 seconds from page open to snapshot creation. We did that in the hopes that we’d see live attacks in the captures.</p>
<div class="highlight">
<pre>cat<span class="p">(</span>sprintf<span class="p">(</span><span class="s">"phantomjs rasterize.js http://%s:%s %s.png 800px*600pxn"</span><span class="p">,</span>
            hm_1<span class="o">$</span>matches<span class="o">$</span>ip_str<span class="p">,</span>
            hm_1<span class="o">$</span>matches<span class="o">$</span>port<span class="p">,</span>
            hm_1<span class="o">$</span>matches<span class="o">$</span>ip_str<span class="p">),</span> file<span class="o">=</span><span class="s">"capture.sh"</span><span class="p">)</span>
</pre>
</div>
<p>That makes <code>capture.sh</code> look something like:</p>
<div class="highlight">
<pre>phantomjs rasterize.js http://199.88.60.245:3000 199.88.60.245.png 800px*600px
phantomjs rasterize.js http://104.131.142.171:3000 104.131.142.171.png 800px*600px
phantomjs rasterize.js http://162.244.29.65:3000 162.244.29.65.png 800px*600px
phantomjs rasterize.js http://192.169.234.171:3000 192.169.234.171.png 800px*600px
phantomjs rasterize.js http://54.148.80.241:3000 54.148.80.241.png 800px*600px
phantomjs rasterize.js http://95.97.211.86:3000 95.97.211.86.png 800px*600px
</pre>
</div>
<p>Yes, there <em>are</em> far more elegant ways to do this, but the number of URLs was small and we had no time constraints. We could have used a<br />
pure phantomjs solution (list of URLs in phantomjs JavaScript) or used<br />
<span class="caps">GNU</span> parallel to speed up the image captures as well.</p>
<p>Sifting through ~140 images manually to see if any had “hits” would not have been <em>too</em> bad, bit a glance at the directory listing showed that many had the exact same size, meaning those were probably showing a default/blank map. We <code>uniq</code>‘d them by <span class="caps">MD5</span> hash and made an image gallery of them:</p>
<style>.wmuGallery .wmuGalleryImage,.wmuSlider .wmuSliderWrapper article{position:relative;text-align:center}.wmuGallery .wmuGalleryImage img,.wmuSlider .wmuSliderWrapper article img{max-width:100%;width:auto;height:auto}.wmuGallery,.wmuSlider{margin-bottom:20px}.wmuSlider{position:relative;overflow:hidden}.wmuSlider .wmuSliderWrapper{display:none}.wmuGallery .wmuGalleryImage{margin-bottom:10px}.wmuSliderNext,.wmuSliderPrev{position:absolute;width:40px;height:80px;text-indent:-9999px;background:url(http://dds.ec/images/sprites.png) no-repeat;top:50%;margin-top:-40px;z-index:2}.wmuSliderPrev{background-position:100% 0;left:20px}.wmuSliderNext{right:20px}.wmuSliderPagination{z-index:2;position:absolute;left:20px;bottom:10px}.wmuSliderPagination li{float:left;margin:0 5px 0 0;list-style-type:none}.wmuSliderPagination a{display:block;text-indent:-9999px;width:10px;height:10px;background:url(http://dds.ec/images/sprites.png) 0 -80px no-repeat}.wmuSliderPagination a.wmuActive{background-position:-10px -80px}</style>
<div style="width:630;height:600">
<div class="wmuSlider">
<div class="wmuSliderWrapper">
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i0.wp.com/dds.ec/galleries/hp/146.83.210.9.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i0.wp.com/dds.ec/galleries/hp/146.83.210.9.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/187.174.195.77.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/187.174.195.77.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/12.45.132.78.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/12.45.132.78.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/54.148.80.241.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/54.148.80.241.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/188.122.73.245.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/188.122.73.245.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/202.12.103.108.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/202.12.103.108.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/45.55.195.250.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/45.55.195.250.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/174.140.165.250.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/174.140.165.250.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/54.183.152.115.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/54.183.152.115.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/81.167.148.253.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/81.167.148.253.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i0.wp.com/dds.ec/galleries/hp/128.199.121.95.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i0.wp.com/dds.ec/galleries/hp/128.199.121.95.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/192.169.69.20.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/192.169.69.20.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i0.wp.com/dds.ec/galleries/hp/192.169.69.25.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i0.wp.com/dds.ec/galleries/hp/192.169.69.25.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/192.167.251.4.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/192.167.251.4.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i0.wp.com/dds.ec/galleries/hp/192.210.204.20.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i0.wp.com/dds.ec/galleries/hp/192.210.204.20.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i2.wp.com/dds.ec/galleries/hp/46.101.24.221.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i2.wp.com/dds.ec/galleries/hp/46.101.24.221.png?w=450" data-recalc-dims="1"/></noscript></article>
<article><img src="https://i0.wp.com/www.r-bloggers.com/wp-content/plugins/lazy-load/images/1x1.trans.gif?ssl=1" data-lazy-src="https://i1.wp.com/dds.ec/galleries/hp/46.101.19.232.png?w=450"  data-recalc-dims="1"><noscript><img src="https://i1.wp.com/dds.ec/galleries/hp/46.101.19.232.png?w=450" data-recalc-dims="1"/></noscript></article>
</div>
</div>
</div>
<p><script type="text/javascript" charset="utf8" src="http://dds.ec/js/modernizr.custom.min.js"></script></p>
<p><script type="text/javascript" charset="utf8" src="http://dds.ec/js/vendor/jquery-1.10.2.min.js"></script></p>
<p><script type="text/javascript" charset="utf8" src="http://dds.ec/js/jquery.touchSwipe.min.js"></script></p>
<p><script type="text/javascript" charset="utf8" src="http://dds.ec/js/jquery.wmuGallery.min.js"></script></p>
<p><script type="text/javascript" charset="utf8" src="http://dds.ec/js/jquery.wmuSlider.min.js"></script></p>
<p><script>$('.wmuSlider').wmuSlider({animation: 'slide',animationDuration: 600,slideshow: true,slideshowSpeed: 7000,slideToStart: 0,navigationControl: true,paginationControl: false,previousText: 'Previous',nextText: 'Next',touch: Modernizr.touch,slide: 'article',items: 1});</script></p>
<p>It was interesting to see Mexico <span class="caps">CERT</span> and OpenDNS in the mix.</p>
<p>Most of the 141 were active/live <span class="caps">MHN</span> HoneyMap sites. We can only imagine what a full Shodan search for HoneyMaps on other ports would come back with (mostly since we only have the basic <span class="caps">API</span> access and don’t want to burn the credits).</p>
<h3 id="episode-3-with-meh-data-comes-great-irresponsibility">Episode 3 : With “Meh” Data Comes Great Irresponsibility</h3>
<p>For those who may not have been with DDSec for it’s entirety, you may not be aware that we have our <em>own</em> <a href="http://ocularwarfare.com/ipew/" rel="nofollow" target="_blank">attack map</a> (<a href="https://github.com/hrbrmstr/pewpew" rel="nofollow" target="_blank">github</a>).</p>
<p>We thought it would be interesting to see if we could mashup <span class="caps">MHN</span> HoneyMap data with our creation. We first had to see what the websocket returned. Here’s a bit of Python to do that (the R <code>websockets</code> package was abandoned by it’s creator, but keep an eye out for another @hrbrmstr resurrection):</p>
<div class="highlight">
<pre><span class="kn">import</span> <span class="nn">websocket</span>
<span class="kn">import</span> <span class="nn">thread</span>
<span class="kn">import</span> <span class="nn">time</span>

<span class="k">def</span> <span class="nf">on_message</span><span class="p">(</span><span class="n">ws</span><span class="p">,</span> <span class="n">message</span><span class="p">):</span>
    <span class="k">print</span> <span class="n">message</span>

<span class="k">def</span> <span class="nf">on_error</span><span class="p">(</span><span class="n">ws</span><span class="p">,</span> <span class="n">error</span><span class="p">):</span>
    <span class="k">print</span> <span class="n">error</span>

<span class="k">def</span> <span class="nf">on_close</span><span class="p">(</span><span class="n">ws</span><span class="p">):</span>
    <span class="k">print</span> <span class="s">"### closed ###"</span>


<span class="n">websocket</span><span class="o">.</span><span class="n">enableTrace</span><span class="p">(</span><span class="bp">True</span><span class="p">)</span>
<span class="n">ws</span> <span class="o">=</span> <span class="n">websocket</span><span class="o">.</span><span class="n">WebSocketApp</span><span class="p">(</span><span class="s">"ws://128.199.121.95:3000/data/websocket"</span><span class="p">,</span>
                            <span class="n">on_message</span> <span class="o">=</span> <span class="n">on_message</span><span class="p">,</span>
                            <span class="n">on_error</span> <span class="o">=</span> <span class="n">on_error</span><span class="p">,</span>
                            <span class="n">on_close</span> <span class="o">=</span> <span class="n">on_close</span><span class="p">)</span>
<span class="n">ws</span><span class="o">.</span><span class="n">run_forever</span><span class="p">()</span>
</pre>
</div>
<p>That particular server is <em>very</em> active, hence why we chose to use it.</p>
<p>The output should look something like:</p>
<div class="highlight">
<pre><span class="nv">$ </span>python ws.py
--- request header ---
<span class="caps">GET</span> /data/websocket <span class="caps">HTTP</span>/1.1
Upgrade: websocket
Connection: Upgrade
Host: 128.199.121.95:3000
Origin: http://128.199.121.95:3000
Sec-WebSocket-Key: <span class="nv">07EFbUtTS4ubl2mmHS1ntQ</span><span class="o">==</span>
Sec-WebSocket-Version: 13


-----------------------
--- response header ---
<span class="caps">HTTP</span>/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: nvTKSyCh+k1Rl5HzxkVNAZjZZUA<span class="o">=</span>
-----------------------
<span class="o">{</span><span class="s2">"city"</span>:<span class="s2">"Clarks Summit"</span>,<span class="s2">"city2"</span>:<span class="s2">"San Francisco"</span>,<span class="s2">"countrycode"</span>:<span class="s2">"<span class="caps">US</span>"</span>,<span class="s2">"countrycode2"</span>:<span class="s2">"<span class="caps">US</span>"</span>,<span class="s2">"latitude"</span>:41.44860076904297,<span class="s2">"latitude2"</span>:37.774898529052734,<span class="s2">"longitude"</span>:-75.72799682617188,<span class="s2">"longitude2"</span>:-122.41940307617188,<span class="s2">"type"</span>:<span class="s2">"p0f.events"</span><span class="o">}</span>
<span class="o">{</span><span class="s2">"city"</span>:<span class="s2">"Clarks Summit"</span>,<span class="s2">"city2"</span>:<span class="s2">"San Francisco"</span>,<span class="s2">"countrycode"</span>:<span class="s2">"<span class="caps">US</span>"</span>,<span class="s2">"countrycode2"</span>:<span class="s2">"<span class="caps">US</span>"</span>,<span class="s2">"latitude"</span>:41.44860076904297,<span class="s2">"latitude2"</span>:37.774898529052734,<span class="s2">"longitude"</span>:-75.72799682617188,<span class="s2">"longitude2"</span>:-122.41940307617188,<span class="s2">"type"</span>:<span class="s2">"p0f.events"</span><span class="o">}</span>
<span class="o">{</span><span class="s2">"city"</span>:null,<span class="s2">"city2"</span>:<span class="s2">"Singapore"</span>,<span class="s2">"countrycode"</span>:<span class="s2">"<span class="caps">US</span>"</span>,<span class="s2">"countrycode2"</span>:<span class="s2">"<span class="caps">SG</span>"</span>,<span class="s2">"latitude"</span>:32.78310012817383,<span class="s2">"latitude2"</span>:1.2930999994277954,<span class="s2">"longitude"</span>:-96.80670166015625,<span class="s2">"longitude2"</span>:103.85579681396484,<span class="s2">"type"</span>:<span class="s2">"p0f.events"</span><span class="o">}</span>
</pre>
</div>
<p>Those are near-perfect <span class="caps">JSON</span> records for our map, so we figured out a way to tell iPew/PewPew (whatever folks are calling it these days) to take any accessible <span class="caps">MHN</span> HoneyMap as a live data source. For example, to plug this highly active HoneyMap into iPew all you need to do is <a href="http://ocularwarfare.com/ipew/?mhnsource=http://128.199.121.95:3000/data/" rel="nofollow" target="_blank">this</a>:</p>
<blockquote>
<p><code>http://ocularwarfare.com/ipew/?mhnsource=http://128.199.121.95:3000/data/</code></p>
</blockquote>
<p>Once we make the websockets component of the iPew map a bit more resilient we’ll post it to GitHub (you can just view the source to try it on your own now).</p>
<h3 id="fin">Fin</h3>
<p>As we stated up front, the main goal of this post is to introduce the <a href="http://github.com/hrbrmstr/mhn" rel="nofollow" target="_blank">mhn package</a>. But, our diversion has us curious. Are the open instances of HoneyMap deliberate or accidental? If any of them are “real” honeypot research or actual production environments, does such an open presence of the <span class="caps">MHN</span> controller reduce the utility of the honeypot nodes? Is Greenland paying ThreatStream to use that map projection instead of a better one?</p>
<p>If you use the new package, found this post helpful (or, at least, amusing) or know the answers to any of those questions, drop a note in the comments.</p>

		<script type='text/javascript'>
		  var vglnk = { key: '949efb41171ac6ec1bf7f206d57e90b8' };

		  (function(d, t) {
			var s = d.createElement(t); s.type = 'text/javascript'; s.async = true;
			s.src = '//cdn.viglink.com/api/vglnk.js';
			var r = d.getElementsByTagName(t)[0]; r.parentNode.insertBefore(s, r);
		  }(document, 'script'));
		</script>		
		
<div id='jp-relatedposts' class='jp-relatedposts' >
	<h3 class="jp-relatedposts-headline"><em>Related</em></h3>
</div><aside class="mashsb-container mashsb-main mashsb-stretched"><div class="mashsb-box"><div class="mashsb-count mash-small" style="float:left;"><div class="counts mashsbcount">24</div><span class="mashsb-sharetext">SHARES</span></div><div class="mashsb-buttons"><a class="mashicon-facebook mash-small mash-center mashsb-noshadow" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F" target="_blank" rel="nofollow"><span class="icon"></span><span class="text">Share</span></a><a class="mashicon-twitter mash-small mash-center mashsb-noshadow" href="https://twitter.com/intent/tweet?text=Modern%20Honey%20Network%20Machinations%20with%20R%2C%20Python%2C%20phantomjs%2C%20HTML%20%26%C2%A0JavaScript&url=https://www.r-bloggers.com/modern-honey-network-machinations-with-r-python-phantomjs-html-javascript/&via=Rbloggers" target="_blank" rel="nofollow"><span class="icon"></span><span class="text">Tweet</span></a><div class="onoffswitch2 mash-small mashsb-noshadow" style="display:none;"></div></div>
            </div>
                <div style="clear:both;"></div></aside>
            <!-- Share buttons by mashshare.net - Version: 3.3.9-->
<p class="syndicated-attribution">
<div style="border: 1px solid; background: none repeat scroll 0 0 #EDEDED; margin: 1px; font-size: 13px;">
<div style="text-align: center;">To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="http://datadrivensecurity.info/blog/posts/2015/Aug/mhn-machinations-r-python-javascript/"> Data Driven Security</a></strong>.</div>
<hr />
<a href="https://www.r-bloggers.com/" rel="nofollow">R-bloggers.com</a> offers <strong><a href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers" rel="nofollow">daily e-mail updates</a></strong> about <a title="The R Project for Statistical Computing" href="https://www.r-project.org/" rel="nofollow">R</a> news and <a title="R tutorials" href="https://www.r-bloggers.com/search/tutorial" rel="nofollow">tutorials</a> on topics such as: <a title="Data science" href="https://www.r-bloggers.com/search/data%20science" rel="nofollow">Data science</a>, <a title="Big Data" href="https://www.r-bloggers.com/search/Big%20Data" rel="nofollow">Big Data, <a title="R jobs" href="https://www.r-users.com/" rel="nofollow">R jobs</a>, visualization (<a title="ggplot and ggplot2 tutorials" href="https://www.r-bloggers.com/search/ggplot2" rel="nofollow">ggplot2</a>, <a title="Boxplots using lattice and ggplot2 tutorials" href="https://www.r-bloggers.com/search/boxplot" rel="nofollow">Boxplots</a>, <a title="Maps and gis" href="https://www.r-bloggers.com/search/map" rel="nofollow">maps</a>, <a title="Animation in R" href="https://www.r-bloggers.com/search/animation" rel="nofollow">animation</a>), programming (<a title="RStudio IDE for R" href="https://www.r-bloggers.com/search/RStudio" rel="nofollow">RStudio</a>, <a title="Sweave and literate programming" href="https://www.r-bloggers.com/search/sweave" rel="nofollow">Sweave</a>, <a title="LaTeX in R" href="https://www.r-bloggers.com/search/LaTeX" rel="nofollow">LaTeX</a>, <a title="SQL and databases" href="https://www.r-bloggers.com/search/SQL" rel="nofollow">SQL</a>, <a title="Eclipse IDE for R" href="https://www.r-bloggers.com/search/eclipse" rel="nofollow">Eclipse</a>, <a title="git and github, Version Control System" href="https://www.r-bloggers.com/search/git" rel="nofollow">git</a>, <a title="Large data in R using Hadoop" href="https://www.r-bloggers.com/search/hadoop" rel="nofollow">hadoop</a>, <a title="Web Scraping of google, facebook, yahoo, twitter and more using R" href="https://www.r-bloggers.com/search/Web+Scraping" rel="nofollow">Web Scraping</a>) statistics (<a title="Regressions and ANOVA analysis tutorials" href="https://www.r-bloggers.com/search/regression" rel="nofollow">regression</a>, <a title="principal component analysis tutorial" href="https://www.r-bloggers.com/search/PCA" rel="nofollow">PCA</a>, <a title="Time series" href="https://www.r-bloggers.com/search/time+series" rel="nofollow">time series</a>, <a title="finance trading" href="https://www.r-bloggers.com/search/trading" rel="nofollow">trading</a>) and more...
</div></p><hr /><hr />
<div style="border: 1px solid #EB9349; background: none repeat scroll 0 0 #FDEADA; text-align: center; margin: 10px; font-size: 16px;">
If you got this far, why not <strong><u>subscribe for updates</u> </strong>from the site?  Choose your flavor: <a href="http://feedburner.google.com/fb/a/mailverify?uri=RBloggers" rel="nofollow">e-mail</a>, <a href="https://twitter.com/#!/rbloggers" rel="nofollow">twitter</a>, <a href="http://feeds.feedburner.com/RBloggers" rel="nofollow">RSS</a>, or <a href="http://www.facebook.com/pages/R-bloggers/191414254890" rel="nofollow">facebook</a>...
</div><div class="social4i" style="height:29px;"><div class="social4in" style="height:29px;float: left;"><div class="socialicons s4fblike" style="float:left;margin-right: 10px;"><div class="fb-like" data-href="https://www.r-bloggers.com/modern-honey-network-machinations-with-r-python-phantomjs-html-javascript/" data-send="true"  data-layout="button_count" data-width="100" data-height="21"  data-show-faces="false"></div></div><div class="socialicons s4linkedin" style="float:left;margin-right: 10px;"><script type="in/share" data-url="https://www.r-bloggers.com/modern-honey-network-machinations-with-r-python-phantomjs-html-javascript/" data-counter="right"></script></div></div><div style="clear:both"></div></div></div>

	</div><!-- #post-## -->



   				<div id="comments">


<div id="comment-user-details">





		<p class="nocomments">Comments are closed.</p>



</div>

</div><!-- #comments -->

       
	</div>
    <!-- begin second sidebar -->
    <div id="secondsidebar">

		
		<div class="side-widget"><form method="get" id="searchform" action="https://www.r-bloggers.com/">
<div>
<input type="text" class="search_input" value="Search & Hit Enter" name="s" id="s" onfocus="if (this.value == 'Search & Hit Enter') {this.value = '';}" onblur="if (this.value == '') {this.value = 'Search & Hit Enter';}" />
<input type="hidden" id="searchsubmit" />
</div>
</form></div><div class="side-widget"><h2>Recent popular posts</h2><ul>				<li>
										<a href="https://www.r-bloggers.com/teach-kids-about-r-with-minecraft/" class="bump-view" data-bump-view="tp">
						Teach kids about R with Minecraft					</a>
									</li>
							<li>
										<a href="https://www.r-bloggers.com/deep-learning-dude-pt-1/" class="bump-view" data-bump-view="tp">
						Deep Learning Dude pt 1					</a>
									</li>
							<li>
										<a href="https://www.r-bloggers.com/linear-algebra-do-not-scale-your-matrix/" class="bump-view" data-bump-view="tp">
						(Linear Algebra) Do not scale your matrix					</a>
									</li>
							<li>
										<a href="https://www.r-bloggers.com/fast-data-loading-from-files-to-r-2/" class="bump-view" data-bump-view="tp">
						Fast data loading from files to R					</a>
									</li>
							<li>
										<a href="https://www.r-bloggers.com/weather-forecast-with-regression-models-part-1/" class="bump-view" data-bump-view="tp">
						Weather forecast with regression models – part 1					</a>
									</li>
			</ul></div><div class="side-widget"><h2>Most visited articles of the week</h2>
<ol class='wppp_list'>
	<li><a href='https://www.r-bloggers.com/how-to-write-the-first-for-loop-in-r/' title='How to write the first for loop in R'>How to write the first for loop in R</a></li>
	<li><a href='https://www.r-bloggers.com/installing-r-packages/' title='Installing R packages'>Installing R packages</a></li>
	<li><a href='https://www.r-bloggers.com/using-apply-sapply-lapply-in-r/' title='Using apply, sapply, lapply in R'>Using apply, sapply, lapply in R</a></li>
	<li><a href='https://www.r-bloggers.com/how-to-make-a-histogram-with-basic-r/' title='How to Make a Histogram with Basic R'>How to Make a Histogram with Basic R</a></li>
	<li><a href='https://www.r-bloggers.com/how-to-perform-a-logistic-regression-in-r/' title='How to perform a Logistic Regression in R'>How to perform a Logistic Regression in R</a></li>
	<li><a href='https://www.r-bloggers.com/how-to-learn-r-2/' title='Tutorials for learning R'>Tutorials for learning R</a></li>
	<li><a href='https://www.r-bloggers.com/teach-kids-about-r-with-minecraft/' title='Teach kids about R with Minecraft'>Teach kids about R with Minecraft</a></li>
	<li><a href='https://www.r-bloggers.com/in-depth-introduction-to-machine-learning-in-15-hours-of-expert-videos/' title='In-depth introduction to machine learning in 15 hours of expert videos'>In-depth introduction to machine learning in 15 hours of expert videos</a></li>
	<li><a href='https://www.r-bloggers.com/data-science-podcasts/' title='Data Science Podcasts'>Data Science Podcasts</a></li>
</ol>
</div><div class="side-widget"><h2>Sponsors</h2>			<div class="textwidget"><script type="text/javascript">

function createCookie(name,value,days) {
    var expires = "";
    if (days) {
        var date = new Date();
        date.setTime(date.getTime() + (days*24*60*60*1000));
        expires = "; expires=" + date.toUTCString();
    }
    document.cookie = name + "=" + value + expires + "; path=/";
}

function readCookie(name) {
    var nameEQ = name + "=";
    var ca = document.cookie.split(';');
    for(var i=0;i < ca.length;i++) {
        var c = ca[i];
        while (c.charAt(0)==' ') c = c.substring(1,c.length);
        if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
    }
    return null;
}

function eraseCookie(name) {
    createCookie(name,"",-1);
}


function readTextFile(file)
{
	// Helps people browse between pages without the need to keep downloading the same 
	// ads txt page everytime. This way, it allows them to use their browser's cache.
	var random_number = readCookie("ad_random_number_cookie");
	if(random_number == null) {
		var random_number = Math.floor(Math.random()*100*(new Date().getTime()/1000));
		createCookie("ad_random_number_cookie",random_number,1)
	}
	
    file += '?t='+random_number;
    var rawFile = new XMLHttpRequest();
    rawFile.onreadystatechange = function ()
    {
        if(rawFile.readyState === 4)
        {
            if(rawFile.status === 200 || rawFile.status == 0)
            {
                // var allText = rawFile.responseText;
                // document.write(allText);
                document.write(rawFile.responseText);
            }
        }
    }
    rawFile.open("GET", file, false);
    rawFile.send(null);
}

// readTextFile('https://raw.githubusercontent.com/Raynos/file-store/master/temp.txt');
readTextFile("https://www.r-bloggers.com/wp-content/uploads/text-widget_anti-cache.txt");

</script>




</div>
		</div><div class="side-widget"><h2><a class="rsswidget" href="https://feeds.feedburner.com/Rjobs"><img class="rss-widget-icon" style="border:0" width="14" height="14" src="https://www.r-bloggers.com/wp-includes/images/rss.png" alt="RSS" /></a> <a class="rsswidget" href="https://www.r-users.com/">Jobs for R users</a></h2><ul><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/eJaeetz-C0o/'>Author Books on R for Packt Publishing</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/pPmmEWLq3uI/'>Software Engineer in Test for RStudio</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/4SwgyGamXqQ/'>Phd opportunity @ Barcelona / Moorepark</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/2Y32Ob2ajAQ/'>Research Software Engineer @ Bailrigg, England</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/z5MOOiRVwu8/'>Senior Data Scientist @ Minneapolis, Minnesota, U.S.</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/Q8Eaow7ysSk/'>Data Scientist / Analytics Consultant</a></li><li><a class='rsswidget' href='http://feedproxy.google.com/~r/RJobs/~3/p1L_-0Qtv-M/'>Data Scientists for ArcelorMittal @ Avilés, Principado de Asturias, Spain</a></li></ul></div><div class="side-widget"><form method="get" id="searchform" action="https://www.r-bloggers.com/">
<div>
<input type="text" class="search_input" value="Search & Hit Enter" name="s" id="s" onfocus="if (this.value == 'Search & Hit Enter') {this.value = '';}" onblur="if (this.value == '') {this.value = 'Search & Hit Enter';}" />
<input type="hidden" id="searchsubmit" />
</div>
</form></div><div class="side-widget">			<div class="textwidget"><strong><a href="https://www.r-bloggers.com/blogs-list/">Full list of contributing R-bloggers</a></strong></div>
		</div>    </div>
<!-- end second sidebar --></div>
<!-- begin footer -->
<div id="footer">
	<strong><a href="https://www.r-bloggers.com">R-bloggers</a></strong> was founded by <a href="http://www.r-statistics.com/about/">Tal Galili</a>, with gratitude to the <a href="http://www.r-project.org/">R</a> community.  <br />
    Is powered by <a href="http://www.wordpress.org">WordPress</a> using a <a href="http://themes.bavotasan.com" rel="nofollow">bavotasan.com</a> design.<br />
    Copyright © 2017 <strong>R-bloggers</strong>. All Rights Reserved. <a href="http://www.r-bloggers.com/terms/">Terms and Conditions</a> for this website<br />
</div>

<!--
TPC! Memory Usage (http://webjawns.com)
Memory Usage: 63010048
Memory Peak Usage: 63942800
WP Memory Limit: 820M
PHP Memory Limit: 512M
Checkpoints: 11
-->

		<div class="wpusb wpusb-buttons wpusb-fixed-right   wpusb-fixed wpusb-layout-buttons-content wpusb-fixed-position_fixed"
		     id="wpusb-container-fixed"
		     data-element-url="https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F%3Futm_source%3Dshare_buttons%26utm_medium%3Dsocial_media%26utm_campaign%3Dsocial_share"
		     data-element-title="Modern%20Honey%20Network%20Machinations%20with%20R%2C%20Python%2C%20phantomjs%2C%20HTML%20%26%C2%A0JavaScript"
		     data-attr-reference="103774"
		     data-is-term="0"
		     data-element="fixed"
		     data-attr-nonce="e1ad424d91"
		      data-disabled-share-counts="1" data-wpusb-component="counter-social-share">

			<div data-element="buttons" class="wpusb-fixed-right-container ">
						<div class="wpusb-item wpusb-facebook ">

				<a href="https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F%3Futm_source%3Dshare_buttons%26utm_medium%3Dsocial_media%26utm_campaign%3Dsocial_share" target="_blank"
				   data-action="open-popup"
				   class="wpusb-layout-buttons wpusb-button wpusb-btn "
				   title="Share on Facebook"
				   
				   
				   rel="nofollow">

				   <i class="wpusb-icon-facebook-buttons "></i>
				</a>
			</div>			<div class="wpusb-item wpusb-twitter ">

				<a href="https://twitter.com/share?url=https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F%3Futm_source%3Dshare_buttons%26utm_medium%3Dsocial_media%26utm_campaign%3Dsocial_share&text=Modern%20Honey%20Network%20Machinations%20with%20R%2C%20Python%2C%20phantomjs%2C%20HTML%20%26%C2%A0JavaScript #rstats #datascience&via=rbloggers" target="_blank"
				   data-action="open-popup"
				   class="wpusb-layout-buttons wpusb-button wpusb-btn "
				   title="Tweet"
				   
				   
				   rel="nofollow">

				   <i class="wpusb-icon-twitter-buttons "></i>
				</a>
			</div>			<div class="wpusb-item wpusb-linkedin ">

				<a href="https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F%3Futm_source%3Dshare_buttons%26utm_medium%3Dsocial_media%26utm_campaign%3Dsocial_share&title=Modern%20Honey%20Network%20Machinations%20with%20R%2C%20Python%2C%20phantomjs%2C%20HTML%20%26%C2%A0JavaScript" target="_blank"
				   data-action="open-popup"
				   class="wpusb-layout-buttons wpusb-button wpusb-btn "
				   title="Share on Linkedin"
				   
				   
				   rel="nofollow">

				   <i class="wpusb-icon-linkedin-buttons "></i>
				</a>
			</div>			<div class="wpusb-item wpusb-google-plus ">

				<a href="https://plus.google.com/share?url=https%3A%2F%2Fwww.r-bloggers.com%2Fmodern-honey-network-machinations-with-r-python-phantomjs-html-javascript%2F%3Futm_source%3Dshare_buttons%26utm_medium%3Dsocial_media%26utm_campaign%3Dsocial_share" target="_blank"
				   data-action="open-popup"
				   class="wpusb-layout-buttons wpusb-button wpusb-btn "
				   title="Share on Google+"
				   
				   
				   rel="nofollow">

				   <i class="wpusb-icon-google-plus-buttons "></i>
				</a>
			</div>				</div>
				<span class="wpusb-toggle"
					  data-action="close-buttons"></span>
			</div>    <script>
        var snp_f = [];
        var snp_hostname = new RegExp(location.host);
        var snp_http = new RegExp("^(http|https)://", "i");
        var snp_cookie_prefix = '';
        var snp_separate_cookies = false;
        var snp_ajax_url = 'https://www.r-bloggers.com/wp-admin/admin-ajax.php';
        var snp_ignore_cookies = false;
        var snp_enable_analytics_events = false;
        var snp_enable_mobile = false;
        var snp_use_in_all = false;
        var snp_excluded_urls = [];
        snp_excluded_urls.push('');    </script>
    <div class="snp-root">
        <input type="hidden" id="snp_popup" value="" />
        <input type="hidden" id="snp_popup_id" value="" />
        <input type="hidden" id="snp_popup_theme" value="" />
        <input type="hidden" id="snp_exithref" value="" />
        <input type="hidden" id="snp_exittarget" value="" />
    	<div id="snppopup-welcome" class="snp-pop-109583 snppopup"><input type="hidden" class="snp_open" value="scroll" /><input type="hidden" class="snp_show_on_exit" value="2" /><input type="hidden" class="snp_exit_js_alert_text" value="" /><input type="hidden" class="snp_open_scroll" value="50" /><input type="hidden" class="snp_optin_redirect_url" value="" /><input type="hidden" class="snp_show_cb_button" value="yes" /><input type="hidden" class="snp_popup_id" value="109583" /><input type="hidden" class="snp_popup_theme" value="theme6" /><input type="hidden" class="snp_overlay" value="disabled" /><input type="hidden" class="snp_cookie_conversion" value="30" /><input type="hidden" class="snp_cookie_close" value="180" /><div class="snp-fb snp-theme6">
    <div class="snp-subscribe-inner">
	<h1 class="snp-header"><i>Never miss an update! </i>
<br/>
<strong>Subscribe to R-bloggers</strong> to receive <br/>e-mails with the latest R posts.<br/>

<small>(You will not see this message again.)</small></h1>	<div class="snp-form">
	    <form action="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers" method="post" class="snp-subscribeform snp_subscribeform">
				<fieldset>
		    <div class="snp-field">
			<input type="text" name="email" id="snp_email" placeholder="Your E-mail..." class="snp-field snp-field-email" />		
		    </div>
		    <button type="submit" class="snp-submit">Submit</button>
		</fieldset>
	    </form>
	</div>
	<a href="#" class="snp_nothanks snp-close">Click here to close (This popup will not appear again)</a>    </div>
    </div>
<style>.snp-pop-109583 .snp-theme6 { max-width: 700px;}
.snp-pop-109583 .snp-theme6 h1 {font-size: 17px;}
.snp-pop-109583 .snp-theme6 { color: #a0a4a9;}
.snp-pop-109583 .snp-theme6 .snp-field ::-webkit-input-placeholder { color: #a0a4a9;}
.snp-pop-109583 .snp-theme6 .snp-field :-moz-placeholder { color: #a0a4a9;}
.snp-pop-109583 .snp-theme6 .snp-field :-ms-input-placeholder { color: #a0a4a9;}
.snp-pop-109583  .snp-theme6 .snp-field input { border: 1px solid #a0a4a9;}
.snp-pop-109583 .snp-theme6 .snp-field { color: #000000;}
.snp-pop-109583 .snp-theme6 { background: #f2f2f2;}
</style></div>    </div>
    <script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushAS3.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushBash.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushColdFusion.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushClojure.js?ver=20090602'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCpp.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCSharp.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCss.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushDelphi.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushDiff.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushErlang.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushFSharp.js?ver=20091003'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushGroovy.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJava.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJavaFX.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJScript.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushLatex.js?ver=20090613'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushMatlabKey.js?ver=20091209'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushObjC.js?ver=20091207'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPerl.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPlain.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPowerShell.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPython.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushR.js?ver=20100919'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushRuby.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushScala.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushSql.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushVb.js?ver=3.0.9b'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushXml.js?ver=3.0.9b'></script>
<script type='text/javascript'>
	(function(){
		var corecss = document.createElement('link');
		var themecss = document.createElement('link');
		var corecssurl = "https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b";
		if ( corecss.setAttribute ) {
				corecss.setAttribute( "rel", "stylesheet" );
				corecss.setAttribute( "type", "text/css" );
				corecss.setAttribute( "href", corecssurl );
		} else {
				corecss.rel = "stylesheet";
				corecss.href = corecssurl;
		}
		document.getElementsByTagName("head")[0].insertBefore( corecss, document.getElementById("syntaxhighlighteranchor") );
		var themecssurl = "https://www.r-bloggers.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.9b";
		if ( themecss.setAttribute ) {
				themecss.setAttribute( "rel", "stylesheet" );
				themecss.setAttribute( "type", "text/css" );
				themecss.setAttribute( "href", themecssurl );
		} else {
				themecss.rel = "stylesheet";
				themecss.href = themecssurl;
		}
		//document.getElementById("syntaxhighlighteranchor").appendChild(themecss);
		document.getElementsByTagName("head")[0].insertBefore( themecss, document.getElementById("syntaxhighlighteranchor") );
	})();
	SyntaxHighlighter.config.strings.expandSource = '+ expand source';
	SyntaxHighlighter.config.strings.help = '?';
	SyntaxHighlighter.config.strings.alert = 'SyntaxHighlighter\n\n';
	SyntaxHighlighter.config.strings.noBrush = 'Can\'t find brush for: ';
	SyntaxHighlighter.config.strings.brushNotHtmlScript = 'Brush wasn\'t configured for html-script option: ';
	SyntaxHighlighter.defaults['pad-line-numbers'] = false;
	SyntaxHighlighter.defaults['toolbar'] = false;
	SyntaxHighlighter.all();
</script>
<link rel='stylesheet' id='wpusb-style-css'  href='https://www.r-bloggers.com/wp-content/plugins/wpupper-share-buttons/assets/stylesheets/style.css?ver=1496217075' type='text/css' media='all' />
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/arscode-ninja-popups/js/jquery.ck.min.js?ver=4.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/arscode-ninja-popups/js/ninjapopups.min.js?ver=4.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/arscode-ninja-popups/fancybox2/jquery.fancybox.min.js?ver=4.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-includes/js/comment-reply.min.js?ver=4.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/themes/magazine-basic/js/effects.js?ver=4.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20130122'></script>
<script type='text/javascript' src='https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201722'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/lazy-load/js/jquery.sonar.min.js?ver=0.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-content/plugins/lazy-load/js/lazy-load.js?ver=0.6.1'></script>
<script type='text/javascript' src='https://www.r-bloggers.com/wp-includes/js/wp-embed.min.js?ver=4.6.1'></script>
	<div id="fb-root"></div>
	<script type="text/javascript" src="https://platform.twitter.com/widgets.js"></script><script type="text/javascript" src="//connect.facebook.net/en_US/all.js#xfbml=1"></script><script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script><script type="text/javascript" src="https://platform.linkedin.com/in.js"></script><script type='text/javascript' src='https://stats.wp.com/e-201722.js' async defer></script>
<script type='text/javascript'>
	_stq = window._stq || [];
	_stq.push([ 'view', {v:'ext',j:'1:4.7.1',blog:'11524731',post:'103774',tz:'-6',srv:'www.r-bloggers.com'} ]);
	_stq.push([ 'clickTrackerInit', '11524731', '103774' ]);
</script>
<script type="text/javascript" src="https://www.r-bloggers.com/wp-content/themes/magazine-basic/js/effects.js"></script> 
<script type="text/javascript">
/* <![CDATA[ */
jQuery(function(){
	jQuery("ul.sf-menu").supersubs({ 
		minWidth:    12,
		maxWidth:    27,
		extraWidth:  1
	}).superfish({ 
		delay:       100,
		speed:       250 
	});	});
/* ]]> */
</script>



</body>
</html>
<!-- Dynamic page generated in 0.811 seconds. -->
<!-- Cached page generated by WP-Super-Cache on 2017-06-04 06:27:25 -->

<!-- Compression = gzip --><script src="https://ajax.cloudflare.com/cdn-cgi/scripts/4f936b58/cloudflare-static/rocket-loader.min.js" data-cf-nonce="9832359492e823a8e58ea4ae-" defer=""></script>