Show HN: Coldframe, a Honeypot that poses as a supermarket refrigeration controller (Score: 150+ in 4 hours) Link: I built Coldframe, a Honeypot that pretends to be a supermarket refrigeration controller. Inspired by the events at industrial facilities in recent weeks, I wanted to see what people would try against a convincing fake. To learn more about this I built a honey brush that perfectly resembles the AK-SM 800A and Dixell XWEB interfaces. Both are recognized by Shodan as real (not as honey). This is a single Python file that uses only the standard library, and builds on eppser/danfos-ak-sm-decoy and public research by Synacktiv, Claroty, and Ironhackers. Things that were fun to get right: matching real units. I used Shodan records of real devices to match header order, page headers, certificate fields and TLS versions. The Danube sends nginx headers in the same order as a real AK-SM 800A. The Dixell Mana does not send a Server Header and appends its page to exactly 8202 bytes. Recognition of exploitation attempts. It knows CVE-2025-41450, the Danfos "code of the day" login bypass, and records if the code being shipped is current. It also shows attempts to target three additional Danophus and XWEB vulnerabilities. bring them in. Default Logins open a fake store dashboard with defrost buttons, so you see the second step, not just the first. Nothing behind it is real. Two live cases for one day. So far they've only seen generic crawlers and Shodan's crawler, called fridge.census.shodan.io. Welcome, especially from anyone who has seen these devices in the & #33; field.

Show HN: Coldframe, a Honeypot that poses as a supermarket refrigeration controller (Score: 150+ in 4 hours) Link: I built Coldframe, a Honeypot that pretends to be a supermarket refrigeration controller. Inspired by the events at industrial facilities in recent weeks, I wanted to see what people would try against a convincing fake. To learn more about this I built a honey brush that perfectly resembles the AK-SM 800A and Dixell XWEB interfaces. Both are recognized by Shodan as real (not as honey). This is a single Python file that uses only the standard library, and builds on eppser/danfos-ak-sm-decoy and public research by Synacktiv, Claroty, and Ironhackers. Things that were fun to get right: matching real units. I used Shodan records of real devices to match header order, page headers, certificate fields and TLS versions. The Danube sends nginx headers in the same order as a real AK-SM 800A. The Dixell Mana does not send a Server Header and appends its page to exactly 8202 bytes. Recognition of exploitation attempts. It knows CVE-2025-41450, the Danfos "code of the day" login bypass, and records if the code being shipped is current. It also shows attempts to target three additional Danophus and XWEB vulnerabilities. bring them in. Default Logins open a fake store dashboard with defrost buttons, so you see the second step, not just the first. Nothing behind it is real. Two live cases for one day. So far they've only seen generic crawlers and Shodan's crawler, called fridge.census.shodan.io. Welcome, especially from anyone who has seen these devices in the & #33; field.