Open-source Coldframe honeypot poses as a supermarket refrigeration controller to trap attackers
A developer group has published Coldframe, an open-source tool that pretends to be a supermarket refrigeration controller and records how attackers try to break in. It imitates Danfoss and Dixell devices and logs passwords and known exploits.
An open-source tool called Coldframe has been published on GitHub. It is a honeypot, a deliberately exposed decoy that imitates a real device so that defenders can observe attackers. In this case, the decoy mimics supermarket refrigeration supervisor controllers. The project has also drawn attention on the tech news and discussion site Hacker News.
According to the project description, attackers in 2026 broke into internet-facing refrigeration supervisors across Europe using default passwords and old, unpatched firmware, then forced defrost cycles. Coldframe pretends to be such a controller. It records who connects, which passwords they try and which public exploits they use, and it never exposes anything real.
Two simulated devices
The tool offers two personas. The first imitates the Danfoss AK-SM 800A system manager, with a StoreView login page, a fake store dashboard and an XML interface. The second imitates the Copeland/Dixell XWEB EVO supervisor. In both cases the authors copied traits recorded by internet scanners on real units, such as server headers and page layout. Weak logins are accepted, and the attacker sees a fake dashboard of refrigerated cases with defrost buttons; every action is only logged. An optional Modbus TCP service, used in industrial systems, can also be switched on.
Recognised exploits
The tool tags requests matching public vulnerabilities in its log, including CVE-2023-25914, CVE-2023-25915, CVE-2025-41450, CVE-2025-41452, CVE-2021-45420 and CVE-2026-25085. Exploit payloads are logged and dropped, not executed.
Safety and limitations
The authors say the tool never runs commands, reads files or forwards traffic, and recommend running it in a container with restricted privileges. They list shallow interaction and the fact that public code can be fingerprinted by its responses among the limitations. The project is released under the MIT licence.
