Fair point and I agree, Shodan isn't the only source. For the reason, for Danfoos the login page comes straight from the firmware package that Danfoss publishes. It's byte for byte identical, so it hashes the same as thousands of real units. Dixell was matched against Shodan records, so that one is weaker, you’re right.

The datacenter IP is the bigger tell. Real controllers sit on shop or ISP connections. Moving one decoy onto a residential line is on my list.

Along the way I did some hunting for vulnerabilities on the Danfass units, quite interesting stuff actually.