The working pattern is a small, isolated sensor on a virtual machine that listens on SSH and HTTP, reduces raw activity to bounded summaries, and forwards them on a timer to a Cloudflare Worker. The Worker stores the summaries in D1 and serves them to a public map. The exposed listener never touches Cloudflare, and the visualization side never accepts a raw SSH connection.
This guide walks through that split, the containment choices that keep the sensor small, the write-budget arithmetic that shapes the pipeline, and the trade-offs between simple polling and live WebSocket updates. The reference design described here is a single author’s deployment, documented in F4LCON’s write-up published on DEV Community on September 29, 2026. Its figures and limits are that author’s own; they are not independent measurements.
As an Amazon Associate I earn from qualifying purchases.
How the pipeline is divided
Keeping two halves conceptually separate is the most important design decision in this project.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- The sensor (exposed): a Rust program running on a VM. It listens on ports 22 and 80, records connection and login events, keeps hourly buckets on local disk, and runs in its own isolated machine so that nothing else on the host is reachable from the internet.
- The ingestion and display side (not exposed to SSH): a Rust program compiled to WebAssembly and deployed as a Cloudflare Worker. It accepts signed requests from the sensor, writes summaries to a D1 database, and serves two read endpoints,
/statsand/recent, that the map page consumes.
The sensor initiates every connection outward. Nothing in the Cloudflare half needs to reach back into the VM, which keeps the firewall rules on the sensor simple: inbound 22 and 80 only, with the VM’s administrative access handled through a separate, restricted path.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step-by-step build
- Provision an isolated VM. Use a dedicated instance with nothing else on it. Do not run the sensor alongside other services, databases, or your own development tools.
- Create an unprivileged service account. The reference design runs the sensor as a user named
hive. Create it with no login shell and no home-directory write access beyond the sensor’s own data path. - Build the sensor and install it under systemd. The unit file should carry the hardening properties described in the reference design. A minimal sketch that uses the real systemd directive names is below; check the systemd documentation for your distribution’s version before relying on it.
- Give the sensor only the port-binding capability. Listening on port 22 and 80 requires
CAP_NET_BIND_SERVICE. Nothing else should be granted. - Deploy the Worker and create the D1 database. Bind the database to the Worker, apply your schema, and store the shared signing secret as a Worker secret rather than in source code.
- Point the sensor at the Worker. Configure the sensor’s forwarding interval (the reference design sends one signed request per minute) and verify that a summary row appears in D1 before you open the sensor to the internet.
- Publish the map. Serve the map page from its own static host or Worker route, and have it poll
/statsand/recent.
[Service]
User=hive
Group=hive
NoNewPrivileges=yes
ProtectSystem=strict
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
SystemCallFilter=@system-service
The directives above mirror the containment the reference author describes: an unprivileged user, a read-only filesystem, no privilege escalation, a syscall filter, and a single bounding capability. The author reports these as implementation facts rather than the output of an independent audit, so test them on your own host before treating the sensor as contained.
Bounding what the sensor records and sends
The sensor does not forward one database row per event. It applies limits at the point of capture and aggregates before anything leaves the VM.
Interaction and containment limits
- SSH logins are rejected. There is no shell and no command execution.
- The HTTP side returns a static page and does not read request bodies.
- Open connections are capped at 256 in total and 10 per IP address.
- Sessions are limited to 30 to 60 seconds.
- Captured strings are truncated to a fixed maximum length, and an internal queue is bounded.
These limits keep the attack surface small and the event volume predictable. They also mean the sensor cannot tell you what an attacker would have done after a successful login, because it never grants one.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Hourly buckets and minute snapshots
Raw events are counted into hourly buckets on disk. Once a minute, the sensor sends a signed summary to the Worker. The Worker stores that summary, and the public endpoints are edge-cached for 30 seconds, so the map updates at most every half minute and the database is queried far less often than the sensor sends.
Why aggregation is a database-budget decision
The reason for batching is concrete. The author’s Cloudflare account runs on the free plan, and in the September 2026 write-up, D1 was cited at 100,000 row writes per day for that plan. Writing one row per SSH attempt would consume that budget quickly on a busy sensor.
The author’s estimate for the summarized flow is about 21 writes per minute, or roughly 30,000 per day (21 × 60 × 24 = 30,240). Those are project-level calculations based on the author’s own event volume. Cloudflare’s plan limits change over time, so confirm the current D1 free-tier quotas on Cloudflare’s pricing and limits pages before you size your own deployment. If your sensor sees more traffic than the author’s, the same arithmetic tells you how much more aggregation you need.
Public map and privacy
The map shows where activity is coming from, not who is behind it. The reference design makes two choices that are worth copying deliberately:
Free tools Windows power users keep installed
One-click scans. No signup required.
- IP addresses are masked to network prefixes on the public map, and only countries are shown.
- Full addresses are retained for a separately authenticated blocklist export rather than being exposed through the public endpoints.
Decide before launch which fields the public endpoints return. Anything you expose on /recent is effectively public and cached at the edge.
Polling or WebSockets for live updates
The reference design does not use WebSockets. Its dashboard refreshes from HTTP endpoints, and the 30-second edge cache is the main control over freshness. For a map that summarizes minute-level data, polling at that cadence is usually enough, and it is the simplest thing to operate.
If you want the browser to receive pushed updates, Cloudflare’s Durable Objects documentation describes WebSockets as a fit for this use. Cloudflare’s documentation for Durable Objects WebSockets states: “WebSockets are long-lived TCP connections that enable bi-directional, real-time communication between client and server.” Cloudflare’s WebSocket server example also warns that an ordinary connected WebSocket keeps its Durable Object in memory and accrues duration charges while the connection stays open. WebSocket Hibernation is the documented way to let idle connections stay open without that cost. Check the current Durable Objects pricing page before choosing this route, because billing terms are the part most likely to have changed.
A Durable Object is a coordination point, not a substitute for the sensor. It can fan updates out to connected browsers, but it does not replace the Worker’s ingestion path, and it does not accept raw SSH traffic.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLow interaction or Cowrie
The reference design is deliberately low-interaction. The alternative most builders consider is Cowrie, an open-source SSH and Telnet honeypot that records login attempts and shell interaction. The two choices answer different questions.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Dimension | Reference design (low interaction) | Cowrie |
|---|---|---|
| Interaction depth | Rejects logins; no shell or command execution | Emulated UNIX shell, and a proxy mode that forwards sessions to a backend |
| Data collected | Connection and login metadata, plus HTTP request metadata | Brute-force attempts plus shell interaction, including commands entered |
| Event volume | Kept small by design and aggregated before forwarding | Not stated in the project description; sessions that enter commands generate more data |
| Installation | Custom Rust sensor built from the author’s code | Installable via pip, Docker, or Git, per the Cowrie project |
| Containment profile | No shell to escape into; strict systemd hardening | Shell emulation and proxying widen what must be contained and monitored |
| Maintenance burden | Single small codebase the builder owns | Upstream project to track; not stated in the project description beyond its installation options |
| Best fit | Public visualization of connection and credential-guessing activity | Analysis of what attackers do after access |
Neither choice is universally safer. A shell-emulating honeypot gives richer observations and a larger surface to contain. A login-rejecting sensor is easier to bound and to explain, but it cannot show post-login behavior. Pick the one that matches the question you want the map to answer.
Figures and their limits
The figures below come from one deployment, reported by its author in 2026. They describe that sensor during the period the author measured, and they are not population-wide SSH statistics. No independent worldwide attack-volume figure was established for this article.
| Figure | Value as reported | Who reported it and under what conditions |
|---|---|---|
| Attempts per day | Around 7,000 | F4LCON, 2026, for the author’s single sensor |
| Unique IPs | Around 130 | F4LCON, 2026, for the author’s single sensor |
| Most-tried password | 123456 |
F4LCON, 2026, for the author’s single sensor |
| D1 row writes, free plan | 100,000 per day | Plan figure quoted in F4LCON’s September 2026 write-up; confirm against current Cloudflare limits |
| Summarized write rate | About 21 per minute, roughly 30,000 per day | Author’s own system-volume estimate, not a Cloudflare benchmark |
Your own numbers will depend on where the sensor is hosted, how long it has been online, and whether it is indexed or listed in scanning datasets. Measure your own sensor for at least a week before publishing any rate.
Troubleshooting before you go public
- No rows in D1: confirm the signed request is reaching the Worker and that the signing secret matches on both sides. Rejected requests are the most common cause of an empty map.
- Map shows stale data: the edge cache holds responses for 30 seconds. A longer delay usually means the sensor has stopped forwarding, so check the systemd unit’s status and logs on the VM.
- Write quota warnings: reduce the forwarding frequency or increase aggregation before adding more sensors. Do not raise the rate of row-level writes to compensate.
- Sensor cannot bind port 22 or 80: check that
CAP_NET_BIND_SERVICEis in the unit’s capability settings and that another process is not already listening on the port.
Who should build this, and what it can show
This project suits builders who want a defensible, public picture of unsolicited SSH and HTTP activity, and who can keep a single sensor isolated and under watch. It is a poor fit for anyone who needs to study attacker behavior after login without expanding the containment work, and for anyone who expects the map to represent global threat activity. The value is in the bounded design: small sensor, batched writes, masked public data, and a plain polling dashboard that you can explain end to end.
Before you deploy, verify the current Cloudflare free-tier limits and Durable Objects pricing, read the systemd and Cowrie documentation for the versions you install, and keep the sensor on a host that has no other role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
