A standing internet-exposure census
At least 4,853 distinct public IP addresses — refrigeration and cold-chain controllers answering on the open internet across 16 European countries, surveyed 2–5 November 2026. Read it as a floor.
These are the controllers anyone can reach: no firewall in the way, no VPN, no login. The count below is where they are, which makers they come from, and — in detail — how rough the number really is.
Industrial refrigeration runs on small controllers — the boxes that hold a cold store, a supermarket aisle or a chilled warehouse at temperature. Many now ship with a web interface for remote management, and many of those end up reachable from the open internet. Usually nobody decided that on purpose; it is a remote-access setup that was left switched on.
ColdWatch counts controllers from four makers — Danfoss, Dixell, Carel and RDM — that answer directly on the public internet across sixteen European countries. The whole count is built from existing internet-wide scan data, so nothing here involved connecting to a device, and each address is counted once. The survey is resurveyed periodically and each reviewed snapshot is dated.
Where the controllers are
Distinct public IP addresses by country, in the 5 November 2026 snapshot. France is about a third of the total; the tail runs down to well under one per cent. Each address is potentially exposed — reachable and fingerprinted, not confirmed at risk.
The raw order tracks the size of each country's internet — its deployed base and its allocated address space — as much as it tracks exposure. Adjust for that and the ranking shifts. It is not a league table of negligence.
Which makers they come from
Matched by product fingerprint. One address can match more than one maker, so these do not sum to the headline — the share is of the 4,853 unique addresses.
How the number was counted
One headline figure sits on a lot of reading and de-duplication. These are the working totals from the last survey.
18,664 matching records read from the public scan engines.
What the number is, and what it is not
Reachable is not the same as hacked. A controller that answers on the internet has not necessarily been attacked, and does not automatically carry a known vulnerability. All the count records is that an interface responded.
Why the real reachable figure is higher
- IPv4 only, and only the default ports and known fingerprints the engines index.
- Only what public scan engines could see and label — anything they miss is uncounted.
- Twenty of twenty-eight query groups hit result caps, so those cells are undercounts.
- A single short observation window, not a continuous watch.
Why the figure genuinely at risk is lower
- Honeypots and decoys: a known share of "exposed" industrial systems are put there to be found.
- Demo units, test boxes and dead hosts answer in scan data too.
- GeoIP attribution can misplace a host near a border or inside a hosting range.
- Reachable says nothing, on its own, about patch level or configuration.
So 4,853 is a floor, and a floor for one thing only: how many of these controllers are reachable. It is not a count of how many are genuinely at risk — for that it runs high, because the demo units, test boxes and dead hosts above answer to a scan just the same. The sixteen countries are the surveyed scope; anywhere not yet surveyed is simply uncounted, which is not the same as confirmed clear.
Method, and keeping it honest
The unit is a single public IPv4 address serving a management interface that matches one of the four products. The match is by fingerprint — the title the web interface serves, the favicon hash of that interface, the shape of its TLS certificate — the signals a product gives off without being probed. Results are limited to the sixteen countries and de-duplicated by IP, so a host seen several ways still counts once.
The headline comes from one engine (Shodan). CriminalIP is reviewed separately as a cross-check and is never folded into the total; where the two engines overlap, the headline stays the more conservative of the counts. Anyone can repeat the method without ever seeing a host list: same engines, same fingerprints, same countries, dedupe by IP. The exact fingerprint set is published in full below — no host list required.
No pins. Every figure on this page is aggregated to a national market — a country or maker total, not a pin on any individual host. No addresses, hostnames, operators, certificate names or banners appear anywhere on it, and there is no map. The host-level data is kept privately, only so it can reach the national CERTs and the makers who can act on it.
The fingerprint set, in full
Exactly what a controller has to be answering for ColdWatch to count it. These are the live queries. Paste one into Shodan and you get the population I counted from — larger than the headline, because this skips the per-country filter and the de-duplication by IP. None of it needs the host list.
-
Danfoss AK-SM 800A CVE-2025-41450 / -41451 / -41452
- TLS cert CN
ssl.cert.subject.cn:"DanfossSM800A"- Favicon hash
http.favicon.hash:-853297641- Page title
http.title:"StoreView"
The certificate CN is near-exact and on-prem. The title match is deliberately broad and pulls in cloud-hosted instances, so it over-counts; the headline leans on the certificate and favicon and dedupes by IP.
-
Dixell XWEB
- Page title
http.title:"XWEB"
-
Carel pCOWeb
- Page title
http.title:"pCOWeb"
-
RDM Intuitive / TDB / Data Manager
- Favicon hash
http.favicon.hash:1434282111
One favicon shared across the RDM product line. These answer over plain HTTP on ports 80, 8080 and 18080 rather than HTTPS, so the certificate signals never see them — the favicon is what catches them.
The queries above are written for one engine (Shodan). CriminalIP is run as a cross-check with the equivalent ssl_subject_common_name and title filters, and is never folded into the headline. Counts are taken inside the sixteen countries and de-duplicated by IP.
A snapshot, not a trend
ColdWatch is not a live feed. It is resurveyed now and then and a reviewed snapshot is published each time. There are two so far.
- 3 November 2026 3,077 across 7 of 28 query groups
- 5 November 2026 4,853 across 16 of 16 countries
The two snapshots were taken at different scope — the first reached only a fraction of the query groups, the second all sixteen countries — so the gap between them is a change in what was looked at, not a measured change on the ground. They are two separate counts, not a trend. Any real movement — addresses that become reachable, ones that go quiet — would only be reported after two surveys of the same scope, counted from the scans themselves and never inferred from the figures on this page.
Published elsewhere
ColdWatch only counts whether a controller is reachable. For what happens once one is reached — the attacks, the flaw, the fix — I defer to the work below and add to this list as things are published.
- A run of attacks on internet-facing refrigeration systems, many in food retail: reach the controller, push the setpoint, and in some cases silence the alarm until the stock has spoiled.
- Freeze the controller, defrost the food — taking over a common Danfoss management unit through its web interface.
- Coordinated disclosure DSA-2025-03-01, with fixed firmware for the affected controllers.
Questions people ask
Is a specific site or company named here?
No. Everything is aggregated to country and maker totals. No addresses, hostnames, operators, certificate names or banners appear anywhere, and there is no map. That will not change.
Does "exposed" mean these have been hacked?
No. It means an interface answered when a scan engine looked — a long way from a known vulnerability, and further still from a breach. See "What the number is, and what it is not" above.
Do you keep the detailed data?
Yes, privately, and only so it can reach the people who can act on it — the national CERTs and the makers. It is not published and not for sale. There is a request form below.
How current is this, and how often does it change?
The figure is the last reviewed survey, dated at the top. It is not live — there is no real-time lookup or API behind it. The survey is repeated now and then and a reviewed snapshot republished, so the number moves in steps.
Who are you, and is this on behalf of an employer?
This is independent security research, published on its own account and not on behalf of any employer. Requests and questions route through the contact below.
Request the underlying data
The public figures are aggregate on purpose. The full host-level dataset exists so it can go to the people who can do something with it. If that is you, get in touch and say which country or constituency you need, and why.
- A national CERT or CSIRT, for the exposures in your country.
- Danfoss, Dixell, Carel or RDM, for devices matching your products.
- A researcher or journalist with a specific, legitimate need.
Requests are logged and shared on a need-to-know basis. Get in touch through c2hk.uk.