ColdWatch exposure census
Standing lower-bound census · snapshot 2026-11-05

Refrigeration controllers answering the open internet.

A passive, aggregate census of cold-chain and building controllers — Danfoss, Dixell, Carel and RDM — that respond on a public IP address across sixteen European national markets. It counts reachable devices. It does not test, touch or log in to any of them.

At least 4,853
distinct public IP addresses running a refrigeration or cold-chain controller that is potentially exposed to the open internet. This is a floor, not a total.
▲ a floor — the real number is higher
16
National markets
18,664
Matched records
4
Controller makers
28
Country × maker cells
+57.7% distinct hosts between the two surveyed snapshots — 3,077 → 4,853 (+1,776), as coverage widened from 7 to 16 national markets. The curve rises because we are looking harder, not because exposure appeared overnight.
Where the exposure sits

Proportional-symbol map

Each marker is sized by the count of exposed hosts in that country and shaded by intensity on a cold-to-hot scale.
Finland — 44 exposed hosts Sweden — 131 exposed hosts Norway — 25 exposed hosts Denmark — 67 exposed hosts Ireland — 55 exposed hosts United Kingdom — 302 exposed hosts Netherlands — 314 exposed hosts Poland — 262 exposed hosts Germany — 253 exposed hosts Belgium — 456 exposed hosts Austria — 72 exposed hosts Switzerland — 43 exposed hosts France — 1,691 exposed hosts Italy — 688 exposed hosts Spain — 332 exposed hosts Portugal — 118 exposed hosts
fewermore exposed
Hover or focus a marker to read its count. France alone accounts for 1,691 hosts — roughly a third of every exposed controller in the census.
Ranked by exposed hosts
FRFrance1,69134.8%
ITItaly68814.2%
BEBelgium4569.4%
ESSpain3326.8%
NLNetherlands3146.5%
GBUnited Kingdom3026.2%
PLPoland2625.4%
DEGermany2535.2%
SESweden1312.7%
PTPortugal1182.4%
ATAustria721.5%
DKDenmark671.4%
IEIreland551.1%
FIFinland440.9%
CHSwitzerland430.9%
NONorway250.5%

How to read the map. Every figure on this page is aggregated to a national market — a country total. A marker is not a pin on any individual host; it is the count for a whole country, placed near its centre only so the eye can find it. No addresses, hostnames, operators, certificate names or banners appear anywhere on this site. Countries with no marker are simply not yet surveyed, not clear.

What the floor is made of

Distribution by country and maker

Exposed hosts by country

Count of distinct public IPs per national market. France dominates the field.

France1,691
Italy688
Belgium456
Spain332
Netherlands314
United Kingdom302
Poland262
Germany253
Sweden131
Portugal118
Austria72
Denmark67
Ireland55
Finland44
Switzerland43
Norway25

Exposed hosts by maker

Share of the 4,853 distinct hosts. Totals exceed the headline because one host can match more than one maker's fingerprint.

DanfossAK-SM / AK-SC site managers2,851
DixellXWEB / Copeland controllers1,495
CarelpCOWeb / BACnet gateways288
RDMResource Data Management228
How the number is built

From raw matches to a defensible floor

18,664
Matched records

Passive fingerprint matches across 28 country × maker cells. The raw haystack, before any de-duplication.

13,811
Overlapping records removed

The same host counted more than once — a second port, a second maker fingerprint, a repeat survey. Collapsed to one host.

4,853
Distinct public IP addresses

What remains after de-duplication: the unique hosts that make up the headline floor.

16
National markets surveyed

Sixteen European countries are covered. The rest of the continent is not yet surveyed — absence here means unmeasured, never safe.

20 / 28
Retrieval-limited cells

In 20 of the 28 cells the query hit a result ceiling, so the true count is higher than shown. Every figure is a lower bound.

0
Host details published

Aggregate country and maker totals only. Per-host data is held privately so it can reach the national CERTs and the makers who can act on it.

Why this is a floor, not a count

Three things push the real number above 4,853. Coverage stops at sixteen national markets, so every unsurveyed country adds hosts this census never saw. In most cells the data source capped how many results it would return, truncating the count before it finished. And passive fingerprinting only recognises devices that answer in a way we already have a signature for — anything behind a reverse proxy, on a non-standard port, or newly modelled slips past.

So read 4,853 as the smallest number consistent with the evidence. The honest statement is "at least this many," and the trend — up 57.7% as soon as we widened coverage — is what you would expect from a floor that moves whenever we look harder.

Primary incident & remediation sources

Where this matters, and where to fix it