Coldframe open-source honeypot mimics Danfoss and Dixell fridge controllers
Coldframe is a Show HN project: a honeypot for supermarket refrigeration controllers. Its README says that in 2026 attackers broke into internet-facing refrigeration supervisors across Europe using default passwords and old, unpatched firmware, then forced defrost cycles. Coldframe pretends to be one of those controllers. It records who connects, what passwords they try and which public exploits they use, and it never gives them anything real. It is one Python file with no dependencies outside the standard library, and it is released under the MIT licence.
There are two personas. The Danfoss persona copies what internet scanners record for real AK-SM 800A units: the nginx server header and header order, the Danfoss StoreView page title, TLS 1.2 only, and a 1-year certificate for CN=DanfossSM800A issued by a SelfSigned-DanfossSM800A authority. Each build generates its own keys. Weak logins (for example Supervisor / 12345) and a correct CVE-2025-41450 code of the day succeed. The attacker then gets a session token and a dashboard of fake refrigerated cases with defrost buttons. Every action is logged as a control event, and nothing is real.
The Dixell persona follows real XWEB EVO units the same way: no Server header, the same security-header set and order, the same asset paths and page size. Its login uses the real /cgi-bin/login.lua flow. The documented factory login Admin / Admin succeeds, five failures in five minutes lock the user, and attempts at the XWEB Pro auth_mode bypass (CVE-2026-25085) are tagged. Per the README, the fingerprints come from Shodan records of exposed units (header set, title, certificate fields) from November 2026.
Both personas can also run an optional Modbus TCP service with fake case temperatures, setpoints and a defrost register. It is off by default, because real AK-SM 800A units only use Modbus to talk to their own case controllers; switching it on is meant to catch generic industrial scanners.
Requests that match a public exploit get an exploit field in the log. The README lists: CVE-2023-25914 (AK-SM 800A path traversal via get_file), CVE-2023-25915 (command injection via load_cert), CVE-2025-41452 (nginx header overwrite via load_nginx_headers), CVE-2025-41450 (the code-of-the-day login bypass, noting whether the attacker computed the correct code), an SM800 code-of-the-day bypass using eds_only/quantum_only on other commands, CVE-2021-45420 (XWEB 500 upload and command paths under /cgi-bin/) and CVE-2026-25085 (XWEB Pro login bypass via an unexpected auth_mode).
Vendor material is kept out of the repository. Real units serve their own favicon, and scanners match devices by its hash, so the icon is not included; for a private deployment you can point FAVICON_FILE at a copy you have the right to use. The same goes for the Danfoss start page, a short Angular loader that thousands of real units share by exact hash. Point INDEX_FILE at that index.html from the public firmware package and the decoy serves it byte for byte, with its original Last-Modified date and ETag; the loader's main.*.js then shows the decoy's own login page.
The README describes how to run it. Locally, PERSONA=danfoss HTTP_PORT=8080 python3 -I honeypot.py serves on localhost:8080, and every request appears as a JSON line on stdout and in events.jsonl. For a server, create an Ubuntu 24.04 machine (the README says a $4 DigitalOcean droplet is plenty), paste cloud-init.yaml into the User data box, and change PERSONA=danfoss to dixell for the XWEB persona. About two minutes after boot the decoy listens on port 80 (and 443 for Danfoss). The container route uses rootful podman or Docker, with a read-only filesystem, all capabilities dropped, no-new-privileges, a user namespace, 128m of memory and a 512 pid limit. A log line records timestamp, persona, protocol, source IP and port, event type and credentials; summary.py turns a log into a short report.
The README also lists hardening and limits. The decoy never runs commands, reads files or forwards traffic, and exploit payloads are logged and dropped. Bodies, fields and connections are capped, with a per-source limit; connections that trickle data are cut after 30 seconds. It admits shallow interaction, a fingerprintable public codebase, some plausible-but-unconfirmed details of real units, and that some scanners flag industrial devices on cloud hosting as likely honeypots. It also points to a similar project, eppser/danfoss-ak-sm-decoy, which adds SNMP and Service Tool listeners and a richer simulated store; coldframe focuses on web fingerprints, specific exploit detection and Dixell XWEB support.
Key facts
- Coldframe is a single-file, standard-library-only Python honeypot under the MIT licence that imitates internet-facing supermarket refrigeration controllers.
- It has two personas: Danfoss AK-SM 800A (nginx headers, TLS 1.2 only, a 1-year self-signed certificate for CN=DanfossSM800A) and Dixell XWEB EVO (real /cgi-bin/login.lua flow, lockout after five failures in five minutes).
- Requests matching public exploits are tagged in the log, including CVE-2023-25914, CVE-2023-25915, CVE-2025-41450, CVE-2025-41452, CVE-2021-45420 and CVE-2026-25085; Modbus TCP is optional and off by default.
- The README suggests a $4 DigitalOcean droplet with cloud-init.yaml, ready about two minutes after boot, or a hardened rootful podman or Docker container.
- Stated limits: shallow interaction, a public codebase that can be fingerprinted, some plausible-but-unconfirmed details of real units, and cloud IPs that some scanners flag as likely honeypots.
Why it matters
The README frames coldframe as a response to 2026 attacks in which intruders got into internet-facing refrigeration supervisors across Europe using default passwords and old unpatched firmware, then forced defrost cycles. The README gives no victims, dates or sources for that claim. What the project adds is a cheap way to watch who probes this kind of equipment: it copies the web fingerprints scanners record for real Danfoss and Dixell units, so the decoy can look like the real thing and capture credentials and exploit attempts. It also tags requests against a specific list of public CVEs for these devices.
Who it affects
Mainly security researchers and defenders who want to watch hostile activity against industrial refrigeration controllers without exposing a real unit. It is relevant to anyone studying attacks on Danfoss AK-SM 800A and Dixell/Copeland XWEB-type devices. Operators of such controllers are an indirect audience: the README lists default passwords and unpatched firmware as how the cited attacks worked, and its exploit list is a record of the public CVEs aimed at those devices.
How to use it
Try it locally with PERSONA=danfoss HTTP_PORT=8080 python3 -I honeypot.py, then open http://localhost:8080; each request shows up as a JSON line on stdout and in events.jsonl. Run the tests with python3 -I test_honeypot.py. For a real deployment, create an Ubuntu 24.04 server, paste cloud-init.yaml into the User data box (switch PERSONA to dixell for the XWEB persona), and in the provider firewall allow only the decoy's ports from anywhere and SSH from your own address. Read the log with ssh root@
How solid is it
The README is detailed and specific, and it cites its references: Danfoss user and XML interface guides, Synacktiv and Claroty Team82 research, Exploit-DB 50639, CISA ICSA-26-057-10, the Copeland XWEB EVO manual and Shodan records from November 2026. The README reports no results from a real deployment: no counts of connections, attackers, captured passwords or exploit attempts. It does not say which of the listed CVEs have actually been seen against the honeypot, and it does not say whether the decoy has been checked against real scanners; it only says it copies their recorded fingerprints. The README names no author or organisation. The 2026 attack claim that motivates the project is not sourced in the text.
Risks and caveats
The README lists its own limits. Interaction is shallow: logged-in attackers see a small dashboard and a handful of XML commands, not the full StoreView app. The code is public, so anyone can read it and spot its exact responses; the README says to change persona strings, page layout and certificate subject for a deployment. Some static paths, the full web app and some XML response shapes of real units are not public, so plausible values are used. Some scanners flag industrial devices on cloud hosting as likely honeypots. On the safety side, log fields are attacker-controlled and should be treated as untrusted; summary.py neutralises terminal escape codes. The README advises exposing only the ports the persona would really have, blocking outbound traffic except DNS and package updates, and keeping SSH reachable only from your own address, since a fridge controller with SSH open to the world looks wrong.
“It records who connects, what passwords they try and which public exploits they use, and it never gives them anything real.”
— coldframe README