Coldframe: Honeypot Mimics Supermarket Fridges
Original: Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller
Why This Matters
ICS/OT honeypots tailored to retail infrastructure fill a gap in threat-intel collection.
Developer hedgerow-dev released Coldframe, a low-interaction honeypot impersonating Danfoss AK-SM 800A and Dixell XWEB 500 refrigeration controllers to log attacker behavior following real 2026 European breaches.
Coldframe is a single Python file with zero external dependencies that poses as internet-exposed supermarket refrigeration supervisors. It was built in direct response to a 2026 wave of attacks across Europe where threat actors exploited default credentials and unpatched firmware on real refrigeration controllers to force defrost cycles — physical disruption via OT/ICS access.
The tool offers two personas. The 'danfoss' persona mimics a Danfoss AK-SM 800A: it reproduces the nginx header order, StoreView page title, TLS 1.2-only handshake, and a self-signed cert with CN=DanfossSM800A — details pulled from what real internet scanners see. The 'dixell' persona impersonates a Copeland/Dixell XWEB EVO supervisor, serving the CGI paths targeted by known public exploits.
Coldframe logs connection attempts, password guesses, and exploit probes without returning anything real. It ships with a container file and cloud-init config for quick deployment, plus a summary script for reviewing captured data. The repo currently sits at 31 stars on GitHub.