Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller

	Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller(github.com)
	285 points by hedgerow-dev 4 days ago \| 69 comments
	tl;dr: Coldframe is a single-file Python honeypot that impersonates internet-exposed supermarket refrigeration controllers (Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO), mimicking their TLS fingerprints, headers, login flows, and XML/CGI APIs down to details scanners use for identification. It logs connection attempts, credential guesses, and recognized exploit payloads (including recent CVEs like 2025-41450 and 2026-25085) as JSON events, without executing anything. It ships with a hardened container setup, optional Modbus listener, and a summary tool, and is MIT-licensed.
	HN Discussion: ~Skepticism about Shodan data and honeypot effectiveness since many exposed devices are already honeypots themselves ↓The honeypot targets wrong attackers since fridge attacks are targeted, not mass-scanned exploits ↓Other industrial hardware (HVAC, chemical plant controllers) would be more valuable honeypot targets ↑Highlights the broader problem that supermarkets lack security teams and vendors should ship secure defaults ↓Questions the wisdom of publicly announcing a honeypot before it has collected meaningful data