GoKawiilDeveloper releases open-source honeypot mimicking supermarket fridge controllers
A new tool called coldframe, built as a single standalone Python file, impersonates Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO refrigeration controllers to lure attackers. It replicates real device details like TLS settings, HTTP headers, login flows, and known exploit paths, logging credentials, exploit attempts and attacker actions without exposing any real system. The project follows reports of 2026 attacks in which hackers used default passwords and unpatched firmware to break into internet-facing refrigeration supervisors across Europe and trigger forced defrost cycles.
GoKawiil's interpretation of the reporting above, not reported fact.
Honeypots like coldframe could give defenders visibility into how attackers scan for and exploit industrial control systems tied to physical infrastructure, such as supermarket cold-storage units. Because the tool closely mimics real vendor fingerprints—headers, certificates, CGI paths—it may help researchers and asset owners detect active exploitation attempts, including specific CVEs, before real equipment is targeted. Its release as lightweight, dependency-free open source suggests it could be easy for smaller organizations to deploy for monitoring their own exposed devices.
- coldframe is a single-file, dependency-free Python honeypot impersonating two real refrigeration controller brands.
- It mimics vendor-specific network fingerprints and known exploit behaviors, including a tagged CVE-2026-25085 bypass attempt.
- The project follows 2026 attacks that exploited default passwords and outdated firmware in European refrigeration systems.
Raspberry Pi 4 Model B — Running lightweight honeypots like coldframe is a perfect use case for a low-power, always-on single-board computer. A Raspberry Pi 4 gives you an isolated, cheap device to safely expose on your network segment for monitoring intrusion attempts without risking real infrastructure.
See Raspberry Pi 4 Model B on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: github.com, 2026-11-07
Published there as: “Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.