TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Coldframe, introduced in a Show HN post and documented on GitHub, is a honeypot that impersonates Danfoss and Dixell supermarket refrigeration supervisors. It logs connections, attempted passwords, recognized exploit requests and simulated control actions without operating real refrigeration equipment. Its performance in real deployments has not been established by the supplied material.
Coldframe, a newly presented honeypot for supermarket refrigeration systems, imitates Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO controllers so operators can record login attempts, requests and simulated control actions. The project’s GitHub documentation says the decoy does not control real equipment; it is intended to capture activity aimed at exposed industrial devices.
The project is packaged as one Python file with no dependencies beyond the standard library, according to its documentation. It offers two personas: a Danfoss-style system manager and a Dixell-style supervisor. Each serves vendor-specific-looking pages and request paths, and the logs record details such as the source IP, protocol, attempted credentials and recognized exploit patterns. The project describes events as JSON lines written to standard output and an events file.
Coldframe’s simulated logins are deliberately permissive in specified ways. For example, its documentation says the Danfoss persona accepts weak credentials such as Supervisor / 12345 and can accept a valid CVE-2025-41450 code-of-the-day login. The Dixell persona accepts the documented factory credentials Admin / Admin; after five failed attempts within five minutes, it locks the user. Successful logins lead to fake dashboards, where button presses are recorded as control events rather than sent to refrigeration equipment.
The software also tags requests matching a list of known exploit patterns, including vulnerabilities identified in the repository as CVE-2023-25914, CVE-2023-25915, CVE-2025-41452 and CVE-2026-25085. An optional Modbus TCP listener can serve fabricated case temperatures, setpoints and a defrost register. It is off by default. The repository recommends limiting exposed ports and outbound network access when deploying the decoy.
Monitoring Attacks on Refrigeration Systems
Refrigeration supervisors can affect equipment used to keep food cold, so unauthorized access to these systems can have consequences beyond a compromised website. The project’s description says attackers broke into internet-facing refrigeration supervisors across Europe in 2026 using default passwords and old, unpatched firmware, then forced defrost cycles. That account is the project’s claim; the supplied materials do not provide independent reporting or incident records to verify its scope.
A decoy can give operators a way to observe what people or automated scanners try against a controller-like interface without putting a working system in front of them. Coldframe’s detailed logging and vendor-specific personas are designed to make those observations more useful than a generic open port. However, a honeypot records activity that reaches the decoy; it does not by itself show how common the same behavior is across real refrigeration networks or prevent attacks on operational equipment.
Products Worth Considering
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
Two Controller Personas and Their Signals
Coldframe’s two personas aim to resemble different products rather than present a generic industrial login page. The Danfoss mode imitates features documented for an AK-SM 800A, including HTTP and HTTPS behavior, StoreView-style pages and XML API paths. The Dixell mode imitates an XWEB EVO supervisor, including its login flow and CGI paths associated with public exploit attempts. The repository says the decoy also matches some response details, such as server headers, page assets and TLS behavior, to resemble the corresponding devices.
Some resemblance options require files from outside the repository. The documentation says vendor artwork, including favicons, is not bundled, and that private deployments may point the software to files the operator has the right to use. It also describes an optional Danfoss firmware loader page. These details matter because the project is designed to be recognized by the same kinds of signals that scanners use to identify devices, not merely by its login form.
The instructions describe running the service in a container or on an Ubuntu server and recommend restricting SSH access, dropping container capabilities and limiting network exposure. These are deployment recommendations from the project documentation, not a guarantee that a particular installation is secure or will preserve accurate source addresses.
“It records who connects, what passwords they try and which public exploits they use, and it never gives them anything real.”
— Coldframe project documentation
Limits of the Available Evidence
The available material describes the software and its intended behavior, but does not report independent testing, a deployment dataset or measured results. It is not clear how often Coldframe has been deployed, how many connection attempts it has recorded, or whether it has identified activity that led to a confirmed security response. The reported 2026 attacks on European refrigeration supervisors are also not independently substantiated in the supplied source material.
The repository lists vulnerabilities and exploit patterns the honeypot recognizes, but it does not establish that every matching request is malicious or that the list covers all relevant techniques. Nor does its documentation establish that the imitations will fool every scanner or attacker. Real-world fidelity can depend on configuration and optional assets, and the source notes that some authentic vendor files are not included.
Deployment and Testing Steps
The project documentation provides a quick-start command, instructions for running tests against a loopback instance and deployment guidance for containerized or Ubuntu installations. Operators who try it can configure either persona, decide whether to enable Modbus, and review the resulting JSON event records. No further release, independent evaluation or planned milestone is specified in the supplied material.
Any assessment of Coldframe’s value will depend on evidence from deployments: the activity it records, whether its logs help distinguish relevant probes from routine scanning, and how closely its responses resemble the intended devices under real network conditions. For now, the confirmed development is the publication of a tool and its operating guidance, not a demonstrated reduction in risk to refrigeration systems.
Key Questions
What is Coldframe?
Coldframe is a honeypot that imitates supermarket refrigeration supervisors from Danfoss and Copeland/Dixell. It records incoming requests and simulated interactions rather than controlling real refrigeration equipment.
What activity does it log?
According to its documentation, it records connection details, attempted passwords, requests matching listed exploit patterns and actions taken on its fake dashboards. Events are written as JSON lines.
Does Coldframe operate a real fridge controller?
No. The project says its dashboards, refrigeration cases and control actions are simulated. Its optional Modbus service also presents fabricated temperatures, setpoints and a defrost register.
Is the honeypot known to have caught real attacks?
The supplied project material describes what Coldframe is designed to record but gives no deployment totals or independently verified findings. Its effectiveness in real-world use remains unclear.
Can it be deployed safely on an internet-facing server?
The documentation provides container and server hardening guidance, including limiting open ports and outbound access. That guidance is not a guarantee of safety; operators would need to review the setup, exposure and logs for their own environment.
Source: github.com
