Live ICS exposure · aggregate · source: Shodan · updated Aug 31, 2026

Shodan Exposures

What’s reachable from the open internet right now — the raw count of U.S. industrial-control endpoints the “How Bad Is It?” meter scores.

68,030

tcp/502 · Modbus

U.S.-reachable Modbus/TCP endpoints

234,504

tcp/20000 · DNP3

U.S.-reachable DNP3 control nodes

61 daily snapshots · trendline tracks DNP3

By SCADA platform · U.S.-reachable

Platform	U.S.	Global
Symphony	296	874
Cygnet	82	114
iFIX	77	240
DeltaV	53	83
Ovation	28	39
OASyS	13	105

By operator · own-network attribution

Named only where an exposed host sits on the operator’s own registered network (its ASN / WHOIS netblock) — high confidence. Reverse-DNS / hostname matches (medium confidence) are not named here.

Operator	Network	Exposed	Basis
Tallgrass Operations, LLC	AS55112	26	own ASN · high
TransCanada Pipelines Ltd. (TC Energy)	AS23229	0	own ASN · high
Enbridge Pipelines Inc.	AS53987	0	own ASN · high

Hostname-attributed · operator internet footprint medium confidence

Hosts tied to an operator by its domain in reverse-DNS or Shodan’s org label. These are the operator’s internet-facing footprint — in this snapshot entirely web / IT (HTTPS, mail, VPN), zero on ICS control ports. Shown for transparency; not counted as ICS exposure, because a hostname/org label is a self-applied nameplate, not proof of who owns the network.

Operator	Domain(s)	Hosts	own-net verified	Attribution
Williams	williams.com	280	0	Shodan org-label · med
Enbridge	enbridge.com, enbridgegas.com	66	0	reverse-DNS · med
Kinder Morgan	kindermorgan.com	61	0	Shodan org-label · med
TC Energy	tcenergy.com, transcanada.com	43	0	reverse-DNS · med
Boardwalk	bwpmlp.com, boardwalkpipelines.com	38	0	reverse-DNS · med
Energy Transfer	energytransfer.com	31	0	Shodan org-label · med
Cheniere	cheniere.com	24	0	Shodan org-label · med
Tallgrass	tallgrassenergylp.com	7	7	own ASN · high

How a row is elevated medium → high. Ownership is confirmed three ways — no host is ever probed: (1) WHOIS / RDAP netblock owner (ARIN/RIPE registry, free) reads as the operator; (2) forward-confirmed reverse-DNS — the PTR name resolves back to the same IP (anti-spoof); (3) ASN ownership — the host sits on the operator’s registered ASN. The “own-net verified” column is how many cleared that bar this run (RDAP-cached, so coverage grows daily). Hosts on cloud/CDN netblocks (Akamai/AWS) confirm the operator’s web presence, not own-network ICS, and stay medium by design.

Cluster endpoints · who actually hosts them

operator-owned 0cloud / hosting 124unattributed 116

Most internet-exposed ICS near these hubs is cloud / hosting-provider infrastructure, not operator-owned — which is why those endpoints carry no operator name.

Where it concentrates

Ashburn / NoVa Data Center Alley26,765

New Albany, OH (Meta Socrates)1,808

Corpus Christi LNG corridor20

Sabine Pass / Cameron LNG19

Permian / Waha (Pecos, TX)1

Read this as exposure, not breach. These are control-protocol services answering on the public internet — an open door is not an intrusion. Figures are a current-state snapshot from Shodan — public, observational data; no host is probed — and drift daily. An operator is named only where an exposed host sits on its own registered network (its ASN / WHOIS netblock); cloud-hosted and unattributed endpoints are not pinned on an operator. Defensive use only.

Source: Shodan · auto-refreshed 2026-08-31 · AI-assisted, not individually fact-checked — verify before you act.