Coldframe - Honeypot posing as supermarket fridge controller
Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller
Coldframe is a low-interaction honeypot that impersonates supermarket refrigeration controllers like the Danfoss AK-SM 800A and Dixell XWEB 500. It mimics real devices' web fingerprints, including headers, TLS certificates, and login flows, to attract attackers. When they connect, it logs their IPs, credentials, and exploit attempts—such as CVE-2025-41450 and CVE-2021-45420—without ever granting real access. Written in a single Python file with no external dependencies, it's easy to deploy via Docker or cloud-init. Coldframe helps security researchers study attacks on critical infrastructure and gather threat intelligence on industrial control systems.
It records who connects, what passwords they try and which public exploits they use, and it never gives them anything real.