Building a Real Time Attack Visualizer: SSH Honeypot and Cloudflare Workers
rust
dev.to
Every second, bots scan the internet for open SSH ports. I wanted to see exactly what they were doing, so I built a honeypot that catches them all and puts them on a live world map. HIVE is a low-interaction honeypot written in Rust. A small sensor pretends to be an SSH server and a forgotten nginx box. Bots find it on their own. Every login attempt and web probe goes to a Cloudflare Worker, and the map at xivlabs.tech shows them as they happen. Right now it's catching around 7000 attempts a d