Independent researchSixteen European countries
Not the ones behind a firewall, or on some private network — the ones that answer, right now, to anyone who knows where to look. This is how many I found, where they are, and exactly how sure I am.
Industrial refrigeration runs on small controllers — the units that hold a cold room, a supermarket aisle, or a chilled warehouse at temperature. More and more of them ship with a web interface, and more and more of those interfaces end up reachable from the public internet, usually because a remote-access shortcut outlived the person who set it up.
I wanted a number for that. So ColdWatch counts how many controllers from four makers — Danfoss, Dixell, Carel, and RDM — answer directly on the public internet across sixteen European countries. It's a standing census I keep current: built by reading existing internet-wide scan data rather than touching any device, and counting each address once. This page is the data and the method, refreshed as I resurvey; the dated write-up of what it means lives in the post alongside it.
4,853+
distinct IP addresses, across 16 countries. That is a floor, not a total — it counts only what the scan engines could see and match, so the real figure is higher.
Below: where they sit on the map, the breakdown by country and maker, how the figure has moved as I've resurveyed, the method in plain terms, what I know is missing, and how to get the detailed data if you have a reason to.
A controller answering on the internet is not a controller that has been attacked, and not necessarily one carrying a known weakness. This counts one thing: an interface that responds.
Some of what I counted will be honeypots, demo units, or hosts that have since gone dark — researchers keep finding that a real share of "exposed" industrial systems are decoys set up to be discovered. So read the figure two ways at once: a floor on how many are reachable, and an overcount of how many are actually at risk. It says these interfaces can be reached. It says nothing about whether any has been misused.
Shaded by how many potentially exposed controllers each country holds. France alone is about a third of everything I saw. The map shades whole countries — it carries no markers for individual sites.
Country boundaries: Natural Earth 1:110m · for orientation only
Only the big picture. There are no pins on this map by design — no operators, hostnames, or per-site locations are published anywhere here.
Raw counts mostly track how big a country's internet is. Divide by population and the order flips: Belgium is the most exposed per resident, then France and the Netherlands; Germany, eighth by count, comes last per head. The headline counts unique IPs — one address can match more than one maker, so the maker columns don't add up to the total.
The headline is one number, but it rests on a lot of reading and de-duplication. These are the working figures from the last reviewed survey.
Observed to · 16 of 16 planned countries measured
ColdWatch isn't live — I resurvey periodically and republish a reviewed snapshot each time, so the number moves in steps. The figure rises mostly as coverage widens across the sixteen countries, not because controllers appear overnight.
Each point is a reviewed publication. Read changes in the visible count alongside changes in country coverage.
The unit is one distinct public IPv4 address serving a management interface that matches one of these products. Nothing here involved connecting to a device. I read the public internet-census engines — Shodan for the headline count, with CriminalIP checked separately and never added to the total — and asked them for the service fingerprints that identify each maker's controller.
By fingerprint I mean the signals a product gives off without being probed: the page title its web interface serves, the favicon hash of that interface, the patterns in its TLS certificate. I restricted results to the sixteen countries, combined the queries, and deduplicated by IP so a host seen several ways is still counted once. That keeps the headline a floor.
You can reproduce the count without ever seeing the host list: query the same engines for the same fingerprints, in the same countries, and dedupe by IP. The exact fingerprint set is available on request.
I'd rather state the gaps than have you find them. This count misses controllers on non-standard ports, hosts the census engines don't cover, and anything that doesn't match my fingerprints. Twenty of the twenty-eight query groups hit the engines' result caps, so several country and maker cells are undercounts. Country attribution is by GeoIP, which gets hosting-provider and border cases wrong. And some of what answers isn't live plant at all. Every one of those pushes the same way: the true number of reachable controllers is higher than the headline, and the number actually at risk is lower.
Refrigeration controllers moved up the agenda in 2026: a national CERT alert and independent research both drew attention to internet-reachable units from these makers, and the makers began publishing coordinated disclosures. ColdWatch measures the scale behind those warnings. For the weaknesses themselves and how to fix them, I defer to the people who own that work.
No. Everything on this page is aggregate — country and maker totals only. No addresses, hostnames, operators, certificate names, or banners appear anywhere on it, and there are no pins on the map. That's deliberate and it isn't going to change.
No. It means an interface answered when a scan engine looked. That's a long way from a known weakness, and a longer way from a breach. See "What the number is not" above.
Yes, privately, and only so it can reach the people who can act on it — the national CERTs and the makers. It isn't published and isn't for sale. There's a request form below.
The figure here is the last reviewed survey, dated at the top. It isn't live — there's no real-time lookup or API behind it. I resurvey periodically and republish a reviewed snapshot each time, so the number moves in steps.
This is independent security research, published on its own account and not on behalf of any employer. Requests and questions route through the contact below.
The public figures are aggregate on purpose. The full host-level dataset exists so it can go to the people who can do something with it. If that's you, get in touch and say which country or constituency you need, and why.
A national CERT or CSIRT, for the exposures in your country
Danfoss, Dixell, Carel, or RDM, for devices matching your products
A researcher or journalist with a specific, legitimate need
Requests are logged and shared on a need-to-know basis. Get in touch through c2hk.uk.