Coldframe is an open-source honeypot designed to detect and log attacks against supermarket refrigeration controllers. According to the project documentation, it was created in response to 2026 incidents where attackers broke into internet-facing refrigeration supervisors across Europe using default passwords and unpatched firmware, then triggered forced defrost cycles.
The honeypot operates by posing as one of two real systems: the Danfoss AK-SM 800A system manager or the Copeland/Dixell XWEB EVO supervisor. It records connection attempts, credential submissions, and which public exploits attackers use, but “never gives them anything real.”
The Danfoss persona mimics the genuine device by copying characteristics that internet scanners record from real units, including the nginx server header, TLS 1.2-only configuration, and a self-signed certificate for CN=DanfossSM800A. Weak credentials like Supervisor/12345 and the correct CVE-2025-41450 “code of the day” authentication bypass succeed, granting access to a fake dashboard with defrost buttons. The Dixell persona similarly reproduces the XWEB EVO’s login flow, factory credentials, and known bypass attempts.
Coldframe detects specific attacks by matching requests against public exploits, including CVE-2023-25914 (path traversal), CVE-2023-25915 (command injection), CVE-2025-41452 (nginx header overwrite), CVE-2025-41450 (code-of-the-day bypass), CVE-2021-45420 (XWEB 500 upload paths), and CVE-2026-25085 (XWEB Pro login bypass). All attacker actions are logged as JSON events with timestamp, IP address, port, and event type.
The implementation is a single Python file with no external dependencies, designed for easy deployment. It can run locally for testing or as a containerized service on cloud infrastructure. The tool includes optional Modbus TCP support to catch generic industrial scanners, though this is disabled by default.
Security measures include request body and connection caps, per-source rate limits, 30-second timeouts for slow data transfers, and a read-only container filesystem with dropped capabilities. The project notes that public code can be fingerprinted and that cloud hosting may trigger scanner suspicion, suggesting custom modifications for sensitive deployments.
Key facts
- Coldframe detects attacks on Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO refrigeration controllers
- The honeypot was created following 2026 attacks in Europe where default credentials and unpatched firmware were exploited to trigger defrost cycles
- It logs seven categories of events including login attempts, control actions, TLS errors, and Modbus activity
- The tool identifies attacks matching multiple CVEs including CVE-2025-41450, CVE-2026-25085, CVE-2023-25914, and CVE-2023-25915
- Coldframe is a single-file Python program with no external dependencies and runs as a containerized service