A standing countSixteen European countries
The ones anyone can reach — no firewall, no VPN, no login, just a browser and the right search. I went looking across sixteen countries in Europe. There were more than I expected. This page is the count, where the controllers are, and how rough that number really is.
Industrial refrigeration runs on small controllers — the boxes that keep a cold store, a supermarket aisle or a chilled warehouse at temperature. A lot of them now ship with a web interface for remote management, and a lot of those end up reachable from the open internet. Usually nobody decided that on purpose. It's a remote-access setup that got left switched on.
I wanted an actual number for how common that is. ColdWatch counts controllers from four makers — Danfoss, Dixell, Carel and RDM — that answer directly on the public internet across sixteen European countries. The whole thing is built from existing internet-wide scan data, so nothing here involved connecting to a device, and each address is counted once. I keep it current and resurvey every so often.
4,853+
distinct IP addresses, across 16 countries. Read it as a floor, not a total. It counts only what the scan engines could see and fingerprint, so the real figure is higher.
Further down: the country and maker breakdown, the map, how I counted, where the count falls short, and how to ask for the detailed data.
A controller that answers on the internet hasn't necessarily been attacked, and it doesn't automatically carry a known vulnerability. All the count tells you is that an interface responded.
Some of what I counted won't be real equipment at all. Honeypots, demo units and dead hosts all turn up in scan data, and researchers keep finding that a fair share of "exposed" industrial systems are decoys put there to be found. So the number pulls in two directions. As a count of what's reachable it's a floor, and the true figure is higher. As a count of what's genuinely at risk it's an overcount, and the real figure is lower.
Shaded by how many potentially exposed controllers I saw in each country. France on its own is about a third of the total. The map colours whole countries; there are no markers for individual sites.
Country boundaries: Natural Earth 1:110m · for orientation only
No pins. The map only shades countries. No operators, hostnames or site locations appear anywhere on this page.
Raw counts mostly follow how big a country's internet is. Adjust for population and the order changes: Belgium comes out most exposed per head, then France and the Netherlands, while Germany — eighth by raw count — drops to last. The headline counts unique IPs, and one address can match more than one maker, so the maker figures don't sum to the total.
One number sits on top of a lot of reading and de-duplication. These are the working figures from the last survey.
Observed to · 16 of 16 planned countries measured
ColdWatch isn't a live feed. I resurvey now and then and publish a reviewed snapshot each time, so the line moves in steps. Most of the rise so far is wider coverage across the sixteen countries, not controllers appearing overnight.
Each point is a reviewed publication. Read changes in the visible count alongside changes in country coverage.
The unit is a single public IPv4 address serving a management interface that matches one of the four products. I didn't connect to anything. The whole count comes from reading the public internet-census engines — Shodan for the headline figure, with CriminalIP checked separately and never folded into the total.
The match is by fingerprint: the title a controller's web interface serves, the favicon hash of that interface, the shape of its TLS certificate — the signals a product gives off without being probed. I limited results to the sixteen countries, ran the queries, and deduplicated by IP so a host seen several ways still counts once. That keeps the headline a floor.
Anyone can repeat this without ever seeing a host list: same engines, same fingerprints, same countries, dedupe by IP. The exact fingerprint set is available on request.
Plenty. It won't catch controllers on odd ports, hosts the scan engines don't index, or anything my fingerprints miss. Twenty of my twenty-eight queries hit the engines' result caps, so some of the country and maker cells are floors rather than real totals. Attribution is by GeoIP, so anything sitting in a hosting provider's range or near a border can land in the wrong country. And some of what answers isn't real plant — test boxes, dead kit, the occasional honeypot.
The gaps don't cancel out. Missed ports and capped queries mean the real reachable number is above 4,853. The honeypots and dead hosts mean the number genuinely at risk is below it. So the headline isn't a measurement. It's a rough middle.
Refrigeration controllers climbed the agenda through 2026. A French national CERT alert and independent research both flagged internet-reachable units from these makers, and the makers started putting out coordinated advisories. ColdWatch measures the scale behind those warnings. For the vulnerabilities themselves, and how to fix them, the sources below are the people to read.
No. Everything on this page is aggregated to country and maker totals. No addresses, hostnames, operators, certificate names or banners appear anywhere on it, and the map has no pins. That won't change.
No. It means an interface answered when a scan engine looked. That's a long way from a known vulnerability, and further still from a breach. There's more on this under "Reachable is not the same as hacked" above.
Yes, privately, and only so it can reach the people who can act on it — the national CERTs and the makers. It isn't published and isn't for sale. There's a request form below.
The figure here is the last reviewed survey, dated at the top. It isn't live — there's no real-time lookup or API behind it. I resurvey now and then and republish a reviewed snapshot, so the number moves in steps.
This is independent security research, published on its own account and not on behalf of any employer. Requests and questions route through the contact below.
The public figures are aggregate on purpose. The full host-level dataset exists so it can go to the people who can do something with it. If that's you, get in touch and say which country or constituency you need, and why.
A national CERT or CSIRT, for the exposures in your country
Danfoss, Dixell, Carel or RDM, for devices matching your products
A researcher or journalist with a specific, legitimate need
Requests are logged and shared on a need-to-know basis. Get in touch through c2hk.uk.