Real requests. Simulated equipment.

ColdTrap observes requests to software decoys resembling refrigeration controllers. Each freezer in the supermarket represents one controller. No physical equipment is connected; temperatures and configuration changes are simulated.

Reading the shop

Blue is normal operation, yellow is discovery, orange is an authentication or suspected exploit attempt, and red means settings changed. Gray means telemetry is unavailable or collection is disabled. Customers are decorative, not attackers.

What you can inspect

Select a request for its captured path, headers, query parameters, and body. Ordinary payload text and identifiers remain readable. Configured infrastructure addresses and credentials are redacted; IP addresses are withheld. Offline databases estimate network operator and country. Responses stay private. Encodings may be normalized and captures truncated.

Observation is not attribution

A request is not proof of an attack. Exploit-like syntax does not prove exploitation, and accepted changes affect only the simulation. Source-country estimates, when available, describe network origins—not identities or sensor locations. Operators may be VPNs or cloud providers; missing estimates remain Unknown. IP geolocation by DB-IP.

Privacy and limits

No sensor addresses or infrastructure details are intentionally published. Redaction handles known addresses and common encodings, but cannot guarantee anonymity: someone actively probing a decoy may correlate it with public activity. This site shows recorded telemetry only.