A passive, aggregate census of cold-chain and building controllers — Danfoss, Dixell, Carel and RDM — that respond on a public IP address across sixteen European national markets. It counts reachable devices. It does not test, touch or log in to any of them.
distinct public IP addresses running a refrigeration or cold-chain controller that is potentially exposed to the open internet.
Each country is shaded by the number of exposed hosts the census found there, and ringed by a marker sized on the same scale. Click a country to pin its figures.
9 advisories, research papers and press reports, 2016 to 2026. 5 of them land in the last eighteen months. Pick one to see the maker and the market it touches.
RDM Intuitive 650 TDB Controller v2.1 and earlier: privilege escalation (CVE-2016-4505) and cross-site request forgery (CVE-2016-4506). Fixed in v2.1.24.
Thousands of internet-exposed Resource Data Management temperature controllers reachable with default credentials (Shodan-based exposure research).
Carel pCOWeb before B1.2.4: plaintext credential storage (CVE-2019-11369) and stored cross-site scripting (CVE-2019-11370).
Unauthenticated directory traversal in logdownload.cgi on Carel pCOWeb HVAC BACnet Gateway (firmware A2.1.0 to B2.1.0). CVSS 7.5.
Original release 2025-05-20; Update A on 2025-08-26 added the command-injection and denial-of-service CVEs. Fixes in R4.2 and R4.3.1.
Copeland/Dixell XWEB 300D/500B/500D PRO, v1.12.1 and earlier. 23 CVEs; the critical one is an unauthenticated OS command-injection path to remote code execution (CVE-2026-24663).
Three Danfoss AK-SM 800A issues: authentication bypass (CVE-2025-41450), command injection (CVE-2025-41451) and denial of service (CVE-2025-41452). Fixed in firmware R4.3.1.
CERT-FR alert on compromises of internet-exposed refrigeration controllers (Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB). Advises removing internet exposure and restricting to VPN.
Refrigeration-control sabotage across roughly 700 French supermarket sites, tied to the Danfoss and Copeland controller families covered by earlier disclosures.
How to read the map. Every figure is aggregated to a national market. A marker is not a pin on any individual host — it is the country total, drawn near the centre so the eye can find it. No addresses, hostnames, operators, certificate names or banners appear on this site. Countries with no marker are not yet surveyed.
Shares of the 4,853 distinct hosts. The four figures add up to more than the headline because a single host can answer with more than one maker's fingerprint.
Passive fingerprint matches across 28 country × maker cells. The raw haystack, before any de-duplication.
The same host counted more than once — a second port, a second maker fingerprint, a repeat survey. Collapsed to one host.
What remains after de-duplication: the unique hosts behind the headline.
Sixteen European countries are covered. The rest of the continent is not yet surveyed — unmeasured, not clear.
In 20 of the 28 cells the query hit a result ceiling, so the true count is higher than shown.
Aggregate country and maker totals only. Per-host data is held privately so it can reach the national CERTs and the makers who can act on it.
Three things push the real number above 4,853. Coverage stops at sixteen national markets, so every unsurveyed country adds hosts this census never saw. In most cells the data source capped how many results it would return, truncating the count before it finished. And passive fingerprinting only recognises devices that answer in a way we already have a signature for — anything behind a reverse proxy, on a non-standard port, or newly modelled slips past.
Widening coverage from seven markets to sixteen raised the count 57.7% in two days. The number tracks how far we have looked, not how much is out there.