Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You build this as two separate systems. A small, isolated virtual machine runs the exposed SSH and HTTP listeners and reduces raw connection activity to bounded summaries. A Rust/WASM Cloudflare Worker receives those summaries over signed requests, stores them in D1, and serves the JSON that a public map page reads. The sensor never exposes a shell, and the Worker never touches a raw SSH connection.
What the finished system does
The reference design comes from F4LCON’s September 2026 write-up, “Building a Real Time Attack Visualizer: SSH Honeypot and Cloudflare Workers,” published on DEV Community. The project is a low-interaction honeypot written in Rust, called HIVE. Its goal is to see what automated bots try against an SSH port and show that activity on a live world map. The figures and implementation details below come from the author’s own description of that deployment. They have not been independently audited.
Split the sensor from the dashboard pipeline
Keep the two halves conceptually and physically apart. The exposed listener is the only part that faces the internet, and it lives on a VM. Cloudflare Workers and D1 handle ingestion, storage and display. Durable Objects and WebSockets are optional tools for pushing live updates to browsers. They are not a way to accept raw SSH connections in this design.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe data moves through six stages:
- The VM sensor listens on ports 22 and 80 and records each connection and login attempt.
- It writes events into hourly buckets on local disk, so a single event never becomes a single database row.
- Once per minute, it sends one signed request containing the summarized window to the Worker.
- The Rust/WASM Worker verifies the signature and writes the summaries to D1.
- D1 backs two read endpoints,
/statsand/recent, which the visualizer calls. - Public endpoints are edge-cached for 30 seconds, so the map does not query D1 on every page view.
Because the sensor only pushes outbound, the Worker never needs to reach into the VM. Keep the signing key on both ends and reject any request that fails verification before it reaches storage.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Lock down the sensor
The sensor is useful only if it cannot become a foothold. The reference project describes the following constraints, all reported by the author rather than verified by an outside test:
- No shell: SSH logins are rejected, and no command is executed.
- Static HTTP: the port 80 side returns a fixed page and never reads request bodies.
- Connection caps: at most 256 open connections in total and 10 per IP address.
- Session limits: sessions are cut off after 30 to 60 seconds.
- Bounded memory: captured strings are length-capped, and the event queue has a fixed size.
- Process confinement: the service runs as an unprivileged
hiveuser under systemd, with a read-only filesystem, the no-new-privileges flag, a syscall filter, and onlyCAP_NET_BIND_SERVICEgranted. - Dedicated host: the sensor runs on its own VM, not alongside anything you care about.
Binding to port 22 means your own administrative SSH must move to another port or be restricted to a management address. Plan that before you point the honeypot at the public internet, or you will lock yourself out of the host.
Aggregate before you write to the database
The author aggregates before forwarding for a concrete reason: one row per event could exhaust the account’s D1 write allowance. The write-up quotes a free-plan limit of 100,000 D1 row writes per day. That number is a dated plan figure from September 2026, so confirm the current limit in Cloudflare’s pricing and limits documentation before you design around it.
Recommended Free Tools
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
With the summarized flow, the author estimates about 21 writes per minute, or roughly 30,000 per day. That estimate is the author’s calculation for their own event volume, not a Cloudflare benchmark. Your volume will depend on how much traffic your address attracts and on your bucket and snapshot intervals.
Two design rules follow from this:
- Choose the bucket size and the forwarding interval first, then check the resulting write rate against the current limit.
- Keep the sensor’s local buffer bounded, so a Worker outage causes dropped or deferred summaries rather than unbounded disk growth.
Protect visitors’ privacy on the map
A public attack map can expose more than it needs to. The reference project masks IP addresses to network prefixes on the public map and shows only countries. Full addresses are kept for a separate blocklist export, which requires its own authentication. Publish the minimum that makes the map interesting, and treat the full-address export as an internal feature.
Choose the interaction depth
How much the honeypot lets an attacker do determines what you learn and how much you must contain. The two options below are the reference low-interaction approach and Cowrie, an established SSH and Telnet honeypot.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
| Criterion | Reference design (low interaction) | Cowrie, emulated shell mode | Cowrie, proxy mode |
|---|---|---|---|
| Interaction depth | Logins are rejected; no shell is offered | An emulated UNIX shell accepts commands | Sessions are forwarded to a backend system |
| Data collected | Connection and login metadata | Brute-force attempts and shell interaction | Session activity on the forwarded backend |
| Implementation and maintenance burden | Not stated in the reference write-up | Not stated in the Cowrie project description | Not stated in the Cowrie project description; the backend adds its own setup |
| Containment requirements | Small attack surface by design, plus the confinement described above | Emulated shell, so no real command execution is intended | A real backend is exposed to the attacker, so it needs strict isolation |
| Best fit | Public activity maps and volume trends | Analysis of what attackers do after login | Studying behavior against a realistic target, with stronger isolation |
Cowrie supports installation with pip, Docker, and Git. Neither option is universally safer. A low-interaction sensor gives you a smaller attack surface and cleaner volume data, but it cannot tell you what an intruder does after a successful login. A richer sensor gives more detail and needs more care in containment.
Refresh the dashboard
The map has two reasonable update strategies. Pick the simplest one that meets your needs.
Polling with edge-cached endpoints
The reference design uses HTTP endpoints with a 30-second edge cache. The browser fetches /stats and /recent on a timer. This is simple to build, easy to debug, and keeps D1 reads low. The trade-off is latency: the map can be up to roughly 30 seconds behind the sensor, plus the polling interval.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Live updates with WebSockets and Durable Objects
Cloudflare describes WebSockets this way: “WebSockets are long-lived TCP connections that enable bi-directional, real-time communication between client and server.” Cloudflare’s Durable Objects documentation covers how Workers and Durable Objects can serve WebSocket endpoints and coordinate clients.
The cost behavior matters. Cloudflare’s WebSocket server guide warns that ordinary connected WebSockets keep a Durable Object in memory, and that connected time is billed as duration. WebSocket hibernation lets the object sleep while clients stay connected, which reduces billable duration during idle periods. Confirm the current pricing and hibernation behavior in Cloudflare’s documentation before you rely on it.
Use WebSockets only if sub-minute freshness is a real requirement. Otherwise the cached polling approach is easier to operate.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Reference figures and what they mean
The following numbers come from one deployment. Treat them as that author’s observations, not as general SSH attack statistics. The reviewed sources do not establish a worldwide figure, so do not use these counts to describe the broader internet.
- Around 7,000 attempts per day — F4LCON, 2026.
- Around 130 unique IPs — F4LCON, 2026.
- The most-tried password was
123456— F4LCON, 2026. - 100,000 D1 row writes per day, a free-plan figure quoted in F4LCON’s September 2026 write-up. Re-verify it against Cloudflare’s current limits.
- About 21 database writes per minute, or roughly 30,000 per day — F4LCON, 2026, a system-volume estimate rather than a Cloudflare performance benchmark.
A third-party repository by Welfordian shows a similar split, with a VPS sensor feeding a Cloudflare ingestion, storage and dashboard pipeline, plus optional Cowrie and sanitized public analytics. It is a useful architecture illustration, not official Cloudflare guidance, and it does not prove that every component is required.
Before you deploy
- Confirm current D1 limits and Durable Objects pricing in Cloudflare’s documentation.
- Move administrative SSH off port 22 or restrict it to a management address.
- Test the signature check so that unsigned or replayed summaries are rejected.
- Decide what the public map shows (prefixes, countries) and keep full addresses out of public endpoints.
- Read your VPS provider’s acceptable-use policy, since hosting an intentionally exposed listener may be restricted.
The reference build reports a free-tier Cloudflare setup, but the write-up does not describe any affiliate arrangement, and this article does not recommend a paid account.
Quick Recap
”
The Bottom Line
“”
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
