Coldframe is an open-source honeypot that replicates the web interfaces of Danfoss AK-SM 800A and Dixell XWEB supermarket refrigeration controllers, matching their HTTP headers, TLS configs, and page layouts to appear as genuine devices on Shodan. It detects and logs known exploit attempts including CVE-2025-41450 and the Danfoss "code of the day" login bypass, then presents attackers with a fake dashboard to observe further activity.
Background
Industrial refrigeration controllers like Danfoss AK-SM and Dixell XWEB have been targeted in recent cyberattacks, prompting researchers to build decoy systems to study attacker TTPs. These devices are often exposed on the internet via Shodan with weak default credentials.
- Source
- Hacker News (RSS)
- Published
- Nov 8, 2026 at 01:27 AM
- Score
- 6.0 / 10