Watch the exposure.
Never endanger the cold chain.

ColdTrap listens for real network requests on isolated, low-interaction software decoys. The supermarket visualizes those observations. Temperatures, appliances, customers, accounts and accepted configuration changes are simulated. No physical refrigeration hardware is connected.

What are OT / ICS systems?

Operational technology (OT) monitors and changes physical processes. Industrial control systems (ICS) are a related class of control equipment and software. Supermarket refrigeration controllers coordinate temperature setpoints, defrost schedules, sensors and alarms. Real-world changes can affect food safety, equipment and business continuity.

Why refrigeration controllers?

Remote management interfaces are useful for maintenance, but exposure to the public internet expands their attack surface. Weak credentials, excessive account privileges, old firmware and unsupported devices can make access unsafe. A request to an exposed controller does not by itself establish malicious intent.

What does a honeypot collect?

A sensor records bounded request metadata, connection timestamps, remote socket address and port, headers, authentication outcomes, response status and simulated state transitions. Credentials and authentication cookies are redacted by default. Events pass over authenticated TLS to an ingestion gateway, then through a durable Redis Stream, PostgreSQL and a reconnectable event stream to this page.

The public interface exposes a strict allow-list: no raw IP addresses, credentials, user agents, arbitrary attacker-controlled paths or private request bodies. Operators can inspect bounded private evidence using authenticated, audited administration endpoints.

Observation is not attribution

• A homepage request is a low-confidence discovery observation, not a successful intrusion.
• A rejected login is a failed attempt. Repeated rejected logins from one source are suspicious, not proof of a specific actor.
• Exploit-like strings indicate a suspected technique. ColdTrap never executes them and cannot confirm exploitability of vendor hardware.
• A simulated successful login requires explicitly fake test credentials. A simulated compromise requires an observed request to change the emulator's state.
• GeoIP estimates describe network infrastructure. VPNs, proxies, carrier NAT and shared hosts prevent reliable identity attribution.
• Profile responses are approximations unless a profile document identifies authorized laboratory evidence. This platform cannot measure vendor market prevalence or real-device vulnerability.

How the supermarket reacts

Each appliance maps to exactly one registered sensor. Blue means normal simulated operation; yellow means recent discovery or fingerprinting; orange means authentication or suspected exploitation; red means an accepted simulated configuration change; gray means disabled or no telemetry in 20 seconds. Recent request highlights expire after 30 seconds. Accepted changes remain red until the simulated process restarts. Lost telemetry does not imply an attack.

Temperature follows T(t) = E + (T₀ − E) × exp(−t / 180), with time in seconds and target equilibrium E. During simulated defrost E is 8 °C. An alarm is raised above −10 °C or while defrost is active. Heartbeats record the evolving model every five seconds. No random attack events drive temperature animations. Customer movement is purely ambient and is never presented as attacker movement.

Reduce real-world risk

• Remove direct internet exposure. Segment OT from corporate and public networks.
• Use a monitored VPN or protected remote-access gateway with MFA and least privilege.
• Replace default and shared credentials. Review inactive accounts and access logs.
• Use supported firmware and apply vendor-approved updates during planned maintenance.
• Audit target temperatures, alarm thresholds and defrost schedules after suspicious activity.
• Keep tested backups of controller configuration and prepare incident-response procedures.
• Do not test exploits on production refrigeration equipment.

Live and demo modes

Live mode displays only stored sensor captures. An empty database shows zero activity. Demo mode replays a deterministic local fixture and displays “SIMULATED DEMO.” It neither submits events to ingestion nor contributes to production statistics. The collector explicitly rejects events marked as demonstrations.

Documentation and public advisories

Advisories apply only to their named products and versions, not automatically to every controller represented here. ColdTrap does not implement vendor vulnerabilities. Review applicability with the manufacturer and asset owner.

• Danfoss AK-SM 800A product documentation
• Copeland controls and monitoring systems
• CISA ICS Advisories — search the exact vendor, model and firmware
• NVD public Danfoss vulnerability references
• NVD public XWEB vulnerability references
• NIST SP 800-82 Rev. 3 — Guide to OT Security

Examples from public records — not implemented exploits

• CVE-2025-41450: NVD describes improper authentication in Danfoss AK-SM 8xxA before version 4.2. See the Danfoss security advisory and verify exact applicability.
• CVE-2025-41451 and CVE-2025-41452: public records describe authenticated command-injection and web-interface configuration risks in AK-SM 8xxA versions before 4.3.1. These records are not evidence that any ColdTrap visitor exploited a real device.
• CVE-2021-45420 and CVE-2021-45421: NVD describes file-write and directory-listing risks in Emerson Dixell XWEB-500 and notes that product's unsupported status. Do not automatically transfer that scope to XWEB PRO or XWEB 500D. Replace unsupported equipment after consulting the vendor.

Ethics and privacy

Deploy only on infrastructure you own or are authorized to use, with hosting-provider approval and an appropriate legal basis. Raw evidence and source addresses expire after seven days; events and private pseudonyms expire after thirty days. Public aggregate counts refer to this retained observation window, not lifetime activity. Operators must assess GDPR obligations, notices, access requests and retention before enabling public listeners.