5 <title>HoneyMap</title>
6 <link rel="stylesheet" href="main.css" type="text/css" media="screen"/>
7 <link rel="stylesheet" href="extern/jquery-jvectormap-1.0.css" type="text/css" media="screen"/>
8 <link rel="stylesheet" href="extern/bootstrap.min.css" type="text/css" media="screen"/>
9 <link href='http://fonts.googleapis.com/css?family=Ubuntu+Mono' rel='stylesheet' type='text/css'>
10 <meta content="Florian Weingarten, Mark Schloesser" name="author" />
11 <script src="/socket.io/socket.io.js"></script>
15 <div id="world-map"></div>
17 <div id="logo1"><a href="http://www.honeynet.org/"><img src="img/hp_logo.png"></a></div>
18 <div id="logo2"><a href="http://www.itsec.rwth-aachen.de/"><img src="img/itsec_logo.png"></a></div>
19 <div id="helpbtn"><a href="#helpmodal" data-toggle="modal"><img src="img/help.png" alt="Help" /></a></div>
21 <div class="modal hide" id="helpmodal" tabindex="-1" role="dialog" aria-labelledby="helpmodal" aria-hidden="true">
22 <div class="modal-header">
23 <button type="button" class="close" data-dismiss="modal" aria-hidden="true">x</button>
26 <div class="modal-body">
28 You are looking at the <b>HoneyMap</b>, a real-time world map which visualizes attacks
29 captured by honeypots of the <a href="http://www.honeynet.org/">Honeynet Project</a>.
30 Red markers on the map represent attackers, yellow markers are targets (honeypot sensors).
33 This project is highly experimental and should be considered an ALPHA version. So far,
34 current Chrome and Firefox browsers should work fine. Opera, Safari and Internet Explorer
35 probably wont work. If you identify bugs or have feature requests, please let us know.
41 <a href="http://jquery.com/">jQuery</a>,
42 <a href="http://jvectormap.com/">jVectorMap</a>,
43 <a href="http://ricostacruz.com/jquery.transit/">jQuery-Transit</a>,
44 <a href="http://twitter.github.com/bootstrap/">bootstrap</a>
48 <a href="http://nodejs.org/">node.js</a>,
49 <a href="http://socket.io/">socket.io</a>,
50 <a href="https://github.com/rep/hpfeeds">hpfeeds</a></li>
54 <li>Florian Weingarten (<a href="mailto:flo@hackvalue.de">flo@hackvalue.de</a>) (<a href="https://twitter.com/fw1729">@fw1729</a>)</li>
55 <li>Mark Schloesser (<a href="mailto:ms@mwcollect.org">ms@mwcollect.org</a>) (<a href="https://twitter.com/repmovsb">@repmovsb</a>)</li>
58 <h3>Frequently Asked Questions</h3>
59 <h4>What am I looking at? Is this real?</h4>
61 Yes, you are looking at real attacks which are
62 captured by our honeypot sensors. Those sensors emulate
63 vulnerable systems and record incoming attacks.
67 <a href="http://dionaea.carnivore.it/">dionaea</a>,
68 <a href="http://glastopf.org/">glastopf</a>, or
69 <a href="https://github.com/buffer/thug">thug</a>.
71 <h4>Where does the data come from?</h4>
72 Some (by far not all) of our sensors publish their captures
73 to our internal feed system
74 (<a href="https://github.com/rep/hpfeeds">hpfeeds</a>).
75 The map backend subscribes to this feed and makes geo location
76 lookups on the corresponding IP addresses.
77 <h4>Is the data representative?</h4>
78 No! Not at all. The Honeynet Project has many more sensors
79 around the world, but only a few push their captures.
80 <h4>What is going on in Aachen?!</h4>
81 Most of the time, you will see attacks targeted against Aachen.
82 This is because our honeypot at RWTH Aachen University is very
83 active and captures attacks against hundreds of target IP
84 addresses. This does not mean that Aachen is attacked more
85 often than the rest of the world!
86 <h4>How can I participate?</h4>
87 If you are already a member of the Honeynet Project, you can
88 just publish your captures to hpfeeds and they will automatically
89 show up on this map. If you are not a member, you can run your own
90 copy of this map on your own server. Code is on GitHub
92 <h4>Why did you create this map?</h4>
93 Just for fun. We like visualization and we wanted to play
94 around with node.js/socket.io. This map was hacked together
95 in essentially 2-3 days.
97 <div class="modal-footer">
98 <button class="btn btn-primary" data-dismiss="modal" aria-hidden="true">Close</button>
102 <script src="hm.js"></script>
103 <script src="welcome.js"></script>
104 <script src="google_analytics.js"></script>