I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team.
If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default.
One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
show comments
asjo
Can't open the link, GitHub is down:
503 Service Unavailable
No server is available to handle this request.
saidnooneever
i think it would be pretty trivial to determine the box is a pot from whois etc.
people who target these supermarket chains etc. are doing just that. not scanning the entire internet and popping all the fridges, but doing targeted attacks.
mostly your pot will just be a +1 on benign peoples scanners.
you want honeypots for things that are mass exploited, not for things used in targeted attacks.
just my 2 cents. respect the project can be fun to do ofc but i wouldnt expect much interesting results.
that being said maybe you can find parties who secure these chains, or themselves, and offer it as a TI sort of service. Seeing as they knew about these vulns for many months before they got hit, its unlikely they will pay for it or be interested.
show comments
gukov
Not a headline I ever expected to read. 2026 has been a wild year.
show comments
mathfailure
Why?
amelius
The interesting aspect of these attacks was that they seemed to have been done per country.
DANmode
Super cool, especially showing your work as FOSS, but: why announce your honeypot before it’s fulfilled its intended purpose once?
show comments
morkalork
You'd probably have more luck posing as other industrial hardware like HVAC, lighting, controllers for the kinds of pumps or valves you'd find in chemical plants. That kind of stuff.
show comments
asdf88990
Did you write this post with AI?
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Given the context, this reads like vomit.
show comments
throwaway2037
Did anyone else notice the badge at the top of the GitHub README.md?
Something about it is cringe to me. It is giving LinkedIn self-promotion vibes.
Melatonic
Very cool. Seems like this is the modern hacker version of "is your refrigerator running?"
IshKebab
The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
show comments
vkaku
Me reading it be like:
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
show comments
xrd
Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.
Is there a definitive story that someone actually did hack these units on a grand scale?
I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
An extra insight, there was some news of 'blood banks' also being targetted. This is possibly a stronger (painful) target. It would demorelize people that are donors. https://www.independent.co.uk/tech/security/blood-hack-fridg...
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
Can't open the link, GitHub is down:
i think it would be pretty trivial to determine the box is a pot from whois etc.
people who target these supermarket chains etc. are doing just that. not scanning the entire internet and popping all the fridges, but doing targeted attacks.
mostly your pot will just be a +1 on benign peoples scanners.
you want honeypots for things that are mass exploited, not for things used in targeted attacks.
just my 2 cents. respect the project can be fun to do ofc but i wouldnt expect much interesting results.
that being said maybe you can find parties who secure these chains, or themselves, and offer it as a TI sort of service. Seeing as they knew about these vulns for many months before they got hit, its unlikely they will pay for it or be interested.
Not a headline I ever expected to read. 2026 has been a wild year.
Why?
The interesting aspect of these attacks was that they seemed to have been done per country.
Super cool, especially showing your work as FOSS, but: why announce your honeypot before it’s fulfilled its intended purpose once?
You'd probably have more luck posing as other industrial hardware like HVAC, lighting, controllers for the kinds of pumps or valves you'd find in chemical plants. That kind of stuff.
Did you write this post with AI?
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Given the context, this reads like vomit.
Did anyone else notice the badge at the top of the GitHub README.md?
Here is the link from the README.md: Something about it is cringe to me. It is giving LinkedIn self-promotion vibes.Very cool. Seems like this is the modern hacker version of "is your refrigerator running?"
The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
Me reading it be like:
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.
Is there a definitive story that someone actually did hack these units on a grand scale?