A standing countSixteen European countries
The ones anyone can reach. No firewall, no VPN, no login, just a browser and the right search. I went looking across sixteen countries in Europe. There were more than I expected. This page is the count, where the controllers are, and how rough that number really is.
Industrial refrigeration runs on small controllers — the boxes that keep a cold store, a supermarket aisle or a chilled warehouse at temperature. A lot of them now ship with a web interface for remote management, and a lot of those end up reachable from the open internet. Usually nobody decided that on purpose. It's a remote-access setup that got left switched on.
I wanted an actual number for how common that is. ColdWatch counts controllers from four makers — Danfoss, Dixell, Carel and RDM — that answer directly on the public internet across sixteen European countries. The whole thing is built from existing internet-wide scan data, so nothing here involved connecting to a device, and each address is counted once. I keep it current and resurvey every so often.
4,853+
distinct IP addresses, across 16 countries. Read it as a floor, not a total — only what the scan engines could see and fingerprint, so the real figure is higher.
Shaded by how many potentially exposed controllers turned up in each country. France alone is about a third of the total. Hover or tap a country for its count.
Hover or tap a country for its count.
No pins. The map shades whole countries — no operators, hostnames or site locations appear anywhere on this page.
Country boundaries: Natural Earth 1:110m · for orientation only
A controller that answers on the internet hasn't necessarily been attacked, and it doesn't automatically carry a known vulnerability. All the count tells you is that an interface responded.
Some of what I counted won't be real equipment at all. Honeypots, demo units and dead hosts all turn up in scan data, and researchers keep finding that a fair share of "exposed" industrial systems are decoys put there to be found. So the number pulls in two directions. As a count of what's reachable it's a floor, and the true figure is higher. As a count of what's genuinely at risk it's an overcount, and the real figure is lower.
When there's an earlier reviewed snapshot to compare against, the movement shows here — addresses that became reachable, ones that went quiet, and the net between them. It only ever reflects my own resurveys, never anyone else's reporting.
First complete snapshot — nothing to compare yet. This is the baseline. After the next resurvey, this block will show what moved between the two, counted from my own scans and never inferred from the headline figures.
Raw counts mostly follow how big a country's internet is. Adjust for population and the order changes: Belgium comes out most exposed per head, then France and the Netherlands, while Germany — eighth by raw count — drops to last. The headline counts unique IPs, and one address can match more than one maker, so the maker figures don't sum to the total.
One number sits on top of a lot of reading and de-duplication. These are the working figures from the last survey.
Observed to · 16 of 16 planned countries measured
ColdWatch isn't a live feed. I resurvey now and then and publish a reviewed snapshot each time, so the line moves in steps. Most of the rise so far is wider coverage across the sixteen countries, not controllers appearing overnight.
Each point is a reviewed publication. Read changes in the visible count alongside changes in country coverage.
The short version is already on this page: read public scan data, match four makers' controllers by fingerprint, count each address once. The working detail — and the honest limits — open up here.
The unit is a single public IPv4 address serving a management interface that matches one of the four products. I didn't connect to anything. The whole count comes from reading the public internet-census engines — Shodan for the headline figure, with CriminalIP checked separately and never folded into the total.
The match is by fingerprint: the title a controller's web interface serves, the favicon hash of that interface, the shape of its TLS certificate — the signals a product gives off without being probed. I limited results to the sixteen countries, ran the queries, and deduplicated by IP so a host seen several ways still counts once. That keeps the headline a floor.
Anyone can repeat this without ever seeing a host list: same engines, same fingerprints, same countries, dedupe by IP. The exact fingerprint set is available on request.
Plenty. It won't catch controllers on odd ports, hosts the scan engines don't index, or anything my fingerprints miss. Twenty of my twenty-eight queries hit the engines' result caps, so some of the country and maker cells are floors rather than real totals. Attribution is by GeoIP, so anything sitting in a hosting provider's range or near a border can land in the wrong country. And some of what answers isn't real plant — test boxes, dead kit, the occasional honeypot.
The gaps don't cancel out. Missed ports and capped queries mean the real reachable number is above 4,853. The honeypots and dead hosts mean the number genuinely at risk is below it. So the headline isn't a measurement. It's a rough middle.
Everything above is my own count of what's reachable. This is the other half — the people who looked at what happens once a controller is reached: the CERT that logged the attacks, the researchers who found the flaw, the maker that shipped the fix. I keep this list by hand and add to it as things are published. The fix for most of what I counted is dull and already written down, so for the specific flaws and the exact remediation I defer to the work below rather than repeat it.
These are other people's findings, not my measurements. ColdWatch only counts whether a controller is reachable — reachability is the one thing a census can measure honestly, and an attack needs a reachable controller to begin with.
No. Everything on this page is aggregated to country and maker totals. No addresses, hostnames, operators, certificate names or banners appear anywhere on it, and the map has no pins. That won't change.
No. It means an interface answered when a scan engine looked. That's a long way from a known vulnerability, and further still from a breach. There's more on this under "Reachable is not the same as hacked" above.
Yes, privately, and only so it can reach the people who can act on it — the national CERTs and the makers. It isn't published and isn't for sale. There's a request form below.
The figure here is the last reviewed survey, dated at the top. It isn't live — there's no real-time lookup or API behind it. I resurvey now and then and republish a reviewed snapshot, so the number moves in steps.
This is independent security research, published on its own account and not on behalf of any employer. Requests and questions route through the contact below.
The public figures are aggregate on purpose. The full host-level dataset exists so it can go to the people who can do something with it. If that's you, get in touch and say which country or constituency you need, and why.
A national CERT or CSIRT, for the exposures in your country
Danfoss, Dixell, Carel or RDM, for devices matching your products
A researcher or journalist with a specific, legitimate need
Requests are logged and shared on a need-to-know basis. Get in touch through c2hk.uk.