Coldframe

What is Coldframe?

Coldframe is a low-interaction honeypot designed to mimic supermarket refrigeration controllers, specifically the Danfoss AK-SM 800A and Dixell XWEB EVO series. It runs as a single Python file using only the standard library, requiring no external dependencies.

The tool simulates two main personas. The Danfoss persona replicates the HTTP headers, TLS settings, login pages, and XML API endpoints found on real units. The Dixell persona mimics the login flow, CGI paths, and security behaviors like account lockouts after failed attempts. Both can optionally run a fake Modbus TCP service to log industrial scanner activity.

When attackers connect, Coldframe records their IP addresses, attempted passwords, and known exploit payloads without granting access to any real equipment. It automatically tags requests matching public CVEs, such as path traversal or command injection flaws. Deployers can replace default assets with vendor-specific images or firmware files to make the decoy indistinguishable from production hardware.

Coldframe features

• Simulates Danfoss AK-SM 800A and Dixell XWEB controller interfaces
• Logs attacker IPs, passwords, and exploit payloads in plain text
• Automatically identifies and tags known CVEs like path traversal and command injection
• Runs as a single Python file with zero external dependencies
• Supports optional fake Modbus TCP service for industrial scanner detection
• Allows custom favicon and index files to perfectly match real hardware

Who uses Coldframe and for what

• Monitor and record unauthorized access attempts against exposed supermarket refrigeration systems
• Gather threat intelligence on active exploitation campaigns targeting ICS devices
• Test network perimeter defenses by deploying decoys alongside production controllers
• Research and analyze common attack vectors and credential stuffing patterns on legacy IoT hardware

Coldframe FAQ

Comments (0)

Comments and upvotes open when this product launches on ProductPerch.