Coldframe is a honeypot mimicking Danfoss and Dixell supermarket refrigeration controllers

Coldframe is a one-file Python honeypot that imitates Danfoss AK-SM 800A and Dixell XWEB interfaces, including details drawn from Shodan records. It detects attempts involving named vulnerabilities and login bypasses, and serves a fake store dashboard after default logins; two instances had been live for one day and had seen only generic scanners and Shodan’s crawler.

The fake dashboard lets defenders observe activity after a login, not just initial probes, which could help characterize attacker behavior. But the initial sample is limited to two instances over one day, and the article reports no targeted attempts yet, so it does not establish how convincing the replicas are to adversaries.