Coldframe presents a mock store dashboard that records attacker interactions without exposing real hardware.
COLDFRAME HONEYPOT MIMICS SUPERMARKET REFRIGERATOR CONTROLLERS
*A single‑file Python honeypot reproduces Danfoss AK‑SM 800A and Dixell XWEB interfaces. It lures scanners, logs exploit attempts, and reveals how little real security surrounds industrial fridge controllers.*
A developer on Hacker News released Coldframe, a honeypot that pretends to be a supermarket refrigeration controller. The project emerged after recent industrial fridge installations drew attention to insecure field devices. Coldframe mirrors the Danfoss AK‑SM 800A and Dixell XWEB interfaces down to header order, TLS version and page size, making it indistinguishable from the real units listed on Shodan. By deploying a perfect replica, the author can watch how scanners and opportunistic attackers interact with what appears to be a critical piece of infrastructure. The tool logs exploit attempts, including a known bypass and several CVEs, while offering a fake dashboard that reveals the attacker’s next steps.
How does Coldframe mimic real refrigeration controllers?
Coldframe copies the exact header order, page titles, certificate fields and TLS versions of the Danfoss AK‑SM 800A and Dixell XWEB units that appear on Shodan. The Danfoss persona emits nginx headers in the same sequence as a genuine AK‑SM 800A. The Dixell persona omits the Server header and pads its page to exactly 8,202 bytes, matching observed real devices. The author built the decoy from Shodan records of authentic units, ensuring the surface fingerprint is indistinguishable from the field‑deployed hardware.
What vulnerabilities does Coldframe detect?
Coldframe watches for attempts against CVE-2025-41450, the Danfoss “code of the day” login bypass, and three other Danfoss CVEs. It also flags exploits targeting the XWEB stack. When a code is submitted, the honeypot records whether it matches the expected value for today. Default logins open a fake store dashboard with defrost buttons, allowing the operator to see the attacker’s second move. No real control logic runs behind the interface.
Who is seeing Coldframe activity?
Two instances have been live for a day. So far they have only attracted generic scanners and Shodan’s crawler, identified as refrigerator.census.shodan.io. No targeted intrusion attempts have been reported yet. The author invites feedback from anyone who has encountered these controllers in the field, hoping to broaden the data set.
What are the limits of the current deployment?
Coldframe runs as a single Python file using only the standard library. It builds on the eppser/danfoss-ak-sm-decoy project and public research by Synacktiv, Claroty and Ironhackers. The honeypot does not expose any real backend; all responses are fabricated. Its visibility is currently limited to the two instances the creator deployed, and it has not yet been tested against sophisticated threat actors beyond Shodan’s automated scans.
Frequently asked questions
What does Coldframe mimic?
Coldframe replicates the Danfoss AK‑SM 800A and Dixell XWEB refrigeration controller interfaces, matching headers, TLS settings and page size.
Which vulnerabilities does Coldframe track?
It detects attempts against CVE-2025-41450, the Danfoss code‑of‑the‑day login bypass, three other Danfoss CVEs and XWEB vulnerabilities.
What traffic has Coldframe seen so far?
In its first day, the two live instances have only encountered generic scanners and Shodan’s refrigerator.census.shodan.io crawler.
The early data suggests that most automated traffic still treats supermarket fridges as low‑risk assets. As Coldframe expands, it could force vendors to harden firmware and expose the true scale of exploitation attempts. Until then, the honeypot remains a stark reminder that critical infrastructure often runs on software as fragile as a grocery store’s ice cream freezer.
Sources: [Hacker News – Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller]