<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/rpad-domain-repurposed-to-deliver-creepy-and-potentially-malicious-content/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2017/08/29/rpad-domain-repurposed-to-deliver-creepy-and-potentially-malicious-content/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>I was about to embark on setting up a background task to sift through R package PDFs for traces of functions that “omit NA values” as a surprise present for Colin Fay and Sir Tierney:</p>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">[Please RT]<a rel="nofollow" href="https://twitter.com/hashtag/RStats?src=hash" target="_blank">#RStats</a> folks, <a rel="nofollow" href="https://twitter.com/nj_tierney" target="_blank"><a rel="nofollow" href="http://twitter.com/nj_tierney" target="_blank">@nj_tierney</a></a> &amp; I need your help for {naniar}!<br>When does R silently drop/omit NA? <a rel="nofollow" href="https://t.co/V5elyGcG8Z" target="_blank">https://t.co/V5elyGcG8Z</a> <a rel="nofollow" href="https://t.co/VScLXFCl2n" target="_blank">pic.twitter.com/VScLXFCl2n</a></p>
<p>— Colin Fay (<a rel="nofollow" href="http://twitter.com/_ColinFay" target="_blank">@_ColinFay</a>) <a rel="nofollow" href="https://twitter.com/_ColinFay/status/902481655260119041" target="_blank">August 29, 2017</a></p></blockquote>
<p></p>
<p>When I got distracted by a PDF in the CRAN <code>doc/contrib</code> directory: <a rel="nofollow" href="https://cran.r-project.org/doc/contrib/Short-refcard.pdf" target="_blank">Short-refcard.pdf</a>. I’m not a big reference card user but students really like them and after seeing what it was I remembered having seen the document ages ago, but never associated it with CRAN before.</p>
<p>I saw:</p>
<blockquote>
<p>by Tom Short, EPRI PEAC, tshort@epri-peac.com 2004-11-07 Granted to the public domain. See www. Rpad. org for the source and latest version. Includes material from R for Beginners by Emmanuel Paradis (with permission).</p>
</blockquote>
<p>at the top of the card. The link (which I’ve made unclickable for reasons you’ll see in a sec — <strong>don’t visit that URL</strong>) was clickable and I tapped it as I wanted to see if it had changed since 2004. </p>
<p><a rel="nofollow" href="https://i1.wp.com/rud.is/b/wp-content/uploads/2017/08/cur_prev.png?ssl=1" target="_blank"><img alt="" src="https://i1.wp.com/rud.is/b/wp-content/uploads/2017/08/cur_prev.png?w=780&ssl=1" class="wp-image-6194" data-recalc-dims="1"></a></p>
<p>You can open that image in a new tab to see the full, rendered site and take a moment to see if you can find the section that links to objectionable — and, potentially malicious — content. It’s easy to spot.</p>
<p>I made a likely correct assumption that Tom Short had nothing to do with this and wanted to dig into it a bit further to see when this may have happened. So, don your bestest deerstalker and follow along as we see when this may have happened.</p>
<h2>Digging In Domain Land</h2>
<p>We’ll need some helpers to poke around this data in a safe manner:</p>
<pre><code>library(wayback) # devtools::install_github(&quot;hrbrmstr/wayback&quot;)
library(ggTimeSeries) # devtools::install_github(&quot;AtherEnergy/ggTimeSeries&quot;)
library(splashr) # devtools::install_github(&quot;hrbrmstr/splashr&quot;)
library(passivetotal) # devtools::install_github(&quot;hrbrmstr/passivetotal&quot;)
library(cymruservices)
library(magick)
library(tidyverse)</code></pre>
<p>(You’ll need to get a RiskIQ PassiveTotal key to use those functions. Also, please donate to Archive.org if you use the <code>wayback</code> package.)</p>
<p>Now, let’s see if the main Rpad content URL is in the wayback machine:</p>
<pre><code>glimpse(archive_available(&quot;http://www.rpad.org/Rpad/&quot;))
## Observations: 1
## Variables: 5
## $ url        </code></pre>