A passive, aggregate census of cold-chain and building controllers — Danfoss, Dixell, Carel and RDM — that respond on a public IP address across sixteen European national markets. It counts reachable devices. It does not test, touch or log in to any of them.
distinct public IP addresses running a refrigeration or cold-chain controller that is potentially exposed to the open internet.
Each country is shaded by the number of exposed hosts the census found there, and ringed by a marker sized on the same scale. Click a country to pin its figures.
17 advisories, research papers and press reports, 2016 to 2026. Ten of them land in the last five weeks. Pick one to see the maker and the market it touches.
RDM Intuitive 650 TDB Controller v2.1 and earlier: privilege escalation (CVE-2016-4505) and cross-site request forgery (CVE-2016-4506). Fixed in v2.1.24.
Thousands of internet-exposed Resource Data Management temperature controllers reachable with default credentials (Shodan-based exposure research).
Carel pCOWeb before B1.2.4: plaintext credential storage (CVE-2019-11369) and stored cross-site scripting (CVE-2019-11370).
Unauthenticated directory traversal in logdownload.cgi on Carel pCOWeb HVAC BACnet Gateway (firmware A2.1.0 to B2.1.0). CVSS 7.5.
Original release 2025-05-20; Update A on 2025-08-26 added the command-injection and denial-of-service CVEs. Fixes in R4.2 and R4.3.1.
Copeland/Dixell XWEB 300D/500B/500D PRO, v1.12.1 and earlier. 23 CVEs; the critical one is an unauthenticated OS command-injection path to remote code execution (CVE-2026-24663).
Three Danfoss AK-SM 800A issues: authentication bypass (CVE-2025-41450), command injection (CVE-2025-41451) and denial of service (CVE-2025-41452). Fixed in firmware R4.3.1.
CERT-FR alert on compromises of internet-exposed refrigeration controllers (Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB). Advises removing internet exposure and restricting to VPN.
More than 800 UK internet-exposed refrigeration and building-management controllers counted, including Danfoss, Carel and Copeland systems.
Attacks on Dixell-equipped stores near Bordeaux and in Tarn, with defrost and temperature settings changed remotely.
Copeland told operators to take XWEB EVO units off the public internet, check them for unauthorised access and plan migration to XWEB PRO.
Refrigeration-control sabotage across roughly 700 French supermarket sites, tied to the Danfoss and Copeland controller families covered by earlier disclosures.
1,960 XWEB EVO, 108 XWEB PRO and 589 Copeland Site Supervisor public IPs counted; Italy led both XWEB EVO and XWEB PRO exposure.
Sweden's NCSC said it was tracking incidents affecting retail refrigeration systems, and told operators to inventory and protect internet-connected OT.
Three British meat suppliers and a produce wholesaler were reached through Copeland XWEB controllers; operators intervened before stock was lost.
Refrigeration systems in several EU member states affected from 11 October, with a further wave of incidents on 1-2 November.
Exposed Danfoss StoreView and Copeland/Dixell XWEB hosts fell 53%, from 6,695 on 9 October to 3,124 on 5 November.
How to read the map. Every figure is aggregated to a national market. A marker is not a pin on any individual host — it is the country total, drawn near the centre so the eye can find it. No addresses, hostnames, operators, certificate names or banners appear on this site. Countries with no marker are not yet surveyed.
Shares of the 4,853 distinct hosts. The four figures add up to more than the headline because a single host can answer with more than one maker's fingerprint.
Passive fingerprint matches across 28 country × maker cells. The raw haystack, before any de-duplication.
The same host counted more than once — a second port, a second maker fingerprint, a repeat survey. Collapsed to one host.
What remains after de-duplication: the unique hosts behind the headline.
Sixteen European countries are covered. The rest of the continent is not yet surveyed — unmeasured, not clear.
In 20 of the 28 cells the query hit a result ceiling, so the true count is higher than shown.
Aggregate country and maker totals only. Per-host data is held privately so it can reach the national CERTs and the makers who can act on it.
Three things push the real number above 4,853. Coverage stops at sixteen national markets, so every unsurveyed country adds hosts this census never saw. In most cells the data source capped how many results it would return, truncating the count before it finished. And passive fingerprinting only recognises devices that answer in a way we already have a signature for — anything behind a reverse proxy, on a non-standard port, or newly modelled slips past.
Widening coverage from seven markets to sixteen raised the count 57.7% in two days. The number tracks how far we have looked, not how much is out there.