Live ICS exposure · aggregate · source: Shodan

Shodan Exposures

What’s reachable from the open internet right now — the raw count of U.S. industrial-control endpoints the “How Bad Is It?” meter scores.

64,468
tcp/502 · Modbus
U.S.-reachable Modbus/TCP endpoints
200,440
tcp/20000 · DNP3
U.S.-reachable DNP3 control nodes
20 daily snapshots · trendline tracks DNP3

By SCADA platform · U.S.-reachable

PlatformU.S.Global
Cygnet6998
iFIX62170
DeltaV2857
Ovation2447
OASyS1183
Wonderware23

By operator · own-network attribution

Named only where an exposed host sits on the operator’s own registered network (its ASN / WHOIS netblock) — high confidence. Reverse-DNS / hostname matches (medium confidence) are not named here.

OperatorNetworkExposedBasis
TransCanada Pipelines Ltd. (TC Energy)AS232290own ASN · high
Enbridge Pipelines Inc.AS539870own ASN · high
Tallgrass Operations, LLCAS551120own ASN · high

Hostname-attributed · operator internet footprint medium confidence

Hosts tied to an operator by its domain in reverse-DNS or Shodan’s org label. These are the operator’s internet-facing footprint — in this snapshot entirely web / IT (HTTPS, mail, VPN), zero on ICS control ports. Shown for transparency; not counted as ICS exposure, because a hostname/org label is a self-applied nameplate, not proof of who owns the network.

OperatorDomain(s)Hostson ICS portsown-net verifiedAttribution
Williamswilliams.com25800Shodan org-label · med
TC Energytcenergy.com, transcanada.com5400reverse-DNS · med
Enbridgeenbridge.com, enbridgegas.com3200reverse-DNS · med
Kinder Morgankindermorgan.com2500Shodan org-label · med
Boardwalkbwpmlp.com, boardwalkpipelines.com2100Shodan org-label · med
Chenierecheniere.com2000Shodan org-label · med
Energy Transferenergytransfer.com1800Shodan org-label · med
Tallgrasstallgrassenergylp.com102own ASN · high
How a row is elevated medium → high. Ownership is confirmed three ways — no host is ever probed: (1) WHOIS / RDAP netblock owner (ARIN/RIPE registry, free) reads as the operator; (2) forward-confirmed reverse-DNS — the PTR name resolves back to the same IP (anti-spoof); (3) ASN ownership — the host sits on the operator’s registered ASN. The “own-net verified” column is how many cleared that bar this run (RDAP-cached, so coverage grows daily). Hosts on cloud/CDN netblocks (Akamai/AWS) confirm the operator’s web presence, not own-network ICS, and stay medium by design.

Cluster endpoints · who actually hosts them

operator-owned 0cloud / hosting 143unattributed 109

Most internet-exposed ICS near these hubs is cloud / hosting-provider infrastructure, not operator-owned — which is why those endpoints carry no operator name.

Where it concentrates

Ashburn / NoVa Data Center Alley24,258
New Albany, OH (Meta Socrates)1,401
Sabine Pass / Cameron LNG37
Corpus Christi LNG corridor14
Read this as exposure, not breach. These are control-protocol services answering on the public internet — an open door is not an intrusion. Figures are a current-state snapshot from Shodan — public, observational data; no host is probed — and drift daily. An operator is named only where an exposed host sits on its own registered network (its ASN / WHOIS netblock); cloud-hosted and unattributed endpoints are not pinned on an operator. Defensive use only.

Source: Shodan · auto-refreshed 2026-07-17 · AI-assisted, not individually fact-checked — verify before you act.