Coldframe is a low‑interaction honeypot that pretends to be a supermarket refrigeration controller, built to study attacks after recent incidents on industrial fridge installations. It emulates Danfoss AK‑SM 800A and Dixell XWEB 500 interfaces, both recognized on Shodan. The project replicates real device behavior: matching header order, TLS settings, certificates, page titles, and even favicon hashes.
It includes default login credentials (Supervisor/12345) and a “code of the day” for CVE-2025-41450, logging any exploit attempts while serving a fake dashboard with defrost buttons. The Dixell persona mirrors XWEB EVO units, tracking login failures and the XWEB Pro auth_mode bypass (CVE‑2026‑25085). Running as a single Python file with no external dependencies, Coldframe has been live for a day and has already seen generic scanners and Shodan’s refrigerator.census.shodan.io.
The author invites feedback from anyone who has encountered these devices in the field.
Source: Hacker News · Summarized by HeadlinesBriefing