An independent security research project16 European countries in scope
Public IPs matching controller signatures
3,077+
appeared in public internet census data across 7 European countries surveyed so far.
Built from public search data, not by contacting any device.
Where the signals showed up.
Measured
Higher count
Not yet surveyed
Country boundaries: Natural Earth 1:110m · For orientation only
Only the big picture. No pins, operators, hostnames, or per-site locations are published.
Why refrigeration, and why now.
Through the autumn of 2026, national authorities and security researchers reported attacks reaching refrigeration controllers over the open internet — in some cases pushing freezers toward unsafe temperatures.
That raised a plain question, setting any single incident aside: how many refrigeration and building-control interfaces are simply visible on the public internet in the first place — and across how much of Europe?
ColdWatch is an independent security research project that tries to answer that at the level of scale: a running count and a map, built only from public search data, so a conversation about getting these systems off the open internet has something concrete to stand on. It is not an official advisory.
The figures point to interfaces that are potentially exposed. A signature match does not reveal who runs a device, how it is configured, or whether it has any weakness — and nothing here says a counted device was ever touched.
How can a visible interface become a real problem?
Every incident is different. This is a plain-language way to understand the connection between an internet-facing management screen and a possible operational impact.
- 01 / Visible
A management screen appears online
A public internet census can record a response that looks like a refrigeration controller's management interface.
- 02 / Found
Someone can discover it
Public search and scanning can make that interface easier to find. Discovery alone gives no one control.
- 03 / Access
A separate weakness opens a way in
Getting further would require a path through access controls, such as an authentication flaw or another software weakness.
- 04 / Impact
Control could affect operations
Depending on the system, unauthorized access could change settings or interfere with monitoring and alarms.
Where this snapshot stops
ColdWatch measures apparent visibility in third-party search data. It does not contact devices or establish that anyone gained access, changed settings, or caused an incident.
This illustration draws on the CERT-FR refrigeration-controller alert ↗ and Claroty Team82's controller research ↗.
The picture is bigger than one number.
The headline counts unique public IPs. Country and vendor views answer different questions, and one IP can appear in more than one vendor column.
Snapshot date
03 NOV 2026
Lower-bound census
By vendor signature
Independent axesBehind the number
How to read this snapshot7,641matching records reviewed
4,564repeat matches removed from the headline
5 / 9query groups with limited retrieval
Several search records may point to one public IP. The headline counts it once. Some searches returned limited results, so the visible total could be larger.
Observed to · 7 of 16 planned countries measured
Watch the picture change
First snapshot01reviewed snapshot
This is the starting point. Later reviewed snapshots can show how the visible count and coverage change.
A snapshot to explore and talk about.
A few things the numbers do and don't say.
- —
The map shows where interfaces turned up; the bars show how many. They answer different questions.
- —
The vendor view counts signature matches, and one public IP can match more than one vendor — so the columns are not mutually exclusive.
- —
Country coverage is still growing, so the total is expected to climb as more of Europe is measured. It is a lower bound, not a ceiling.
A shareable number, with its context.
This snapshot comes from passive, third-party search data. It counts unique public IPs matching controller signatures across the countries shown here. Keeping the date and scope with the number helps people read it fairly. The data does not assess any vendor or individual device.
- Project
- ColdWatch
- Snapshot
- 3 November 2026
- Measure
- Unique public IPs
- Scope
How the picture is made, and where it blurs.
It only reads public data
ColdWatch queries third-party internet census platforms. It never connects to a controller or tests a suspected weakness.
The count leans low on purpose
The headline deduplicates matching records by public IP. Capped retrievals make this publication a lower bound, not a claim of completeness.
Only totals are published
Only country and vendor totals leave the private research store. IPs, hostnames, operators, certificates, and locations never enter this site.
Every snapshot is reviewed by hand
There is no live search or public API. Every update is exported, inspected, and deliberately published as a static snapshot.
Current scope Belgium, France, Germany, Italy, Netherlands, Spain, United Kingdom.
Next coverage Austria, Switzerland, Denmark, Finland, Ireland, Norway, Poland, Portugal, Sweden.