Tools / OT Exposure
Is a fridge controller answering to the whole internet?
The controllers that run refrigeration, heating and building services are not supposed to be reachable from the internet, but a surprising number are — usually put there by a contractor for remote access, without anyone recording the firewall change. Enter your organisation’s public IP range and find out, in one database lookup, whether any of them is answering.
Danfoss · Carel · Copeland / Emerson · Tridium Niagara · BACnet device · Siemens Desigo · Schneider StruxureWare · Sauter moduWeb · Delta enteliWEB · Lantronix · eWON · Moxa NPort · SMA Sunny WebBox · SMAFree · No network scan · No sign-up · PDF report
What it checks
Refrigeration controllers
Danfoss AK-SM / AK-SC system managers, Carel pCO controllers behind their pCOWeb card, and Copeland (Emerson) XWEB units — the systems that run cold aisles, cold stores and chillers in retail, distribution and food production.
Building management
Tridium Niagara stations on the Fox protocol — the platform under a great many UK building systems — plus Siemens Desigo, Schneider StruxureWare, Sauter moduWeb and Delta enteliWEB front ends, handling heating, lighting, access and metering.
The building-automation protocol
Devices answering BACnet directly from the internet. BACnet has no authentication of its own, so an exposed device can usually be read, and often written to, by anyone who can reach it.
Remote-access gateways
Lantronix and Moxa serial-to-network device servers and eWON remote-access routers — the boxes a contractor installs to reach plant from off site. Exposed directly, they are a line straight into whatever they are bridging, usually with no authentication of their own.
Solar and energy monitors
SMA Sunny WebBox data gateways and SMA inverter interfaces. On the public internet they reveal the installation and, on older firmware, let its settings be changed.
Only your own addresses
You enter the public range your organisation owns. The check tells you only what is answering on an address you entered — it never lists anyone else's, and it never connects to your network. The answer is a database lookup, not a scan.
Genuine signatures, not guesses
Each controller is matched on the signature that actually identifies it, not a loose vendor-name match in a web page (those over-count badly). A result here is a device that really is responding.
What to do about it
Every match comes with its address, port and the one fix that matters: take the controller off the public internet, behind the firewall and a VPN, and change the default password.
Why this matters
In October 2026 an attack on a refrigeration supplier defrosted chilled cabinets across a chain of French supermarkets. The route in was the same one that keeps turning up: a building controller reachable from the internet, with the manufacturer’s default password still on it. From that one interface an attacker can change temperature set-points, silence the alarms that would warn staff, and shut plant down — and the first anyone knows is spoiled stock or a cold store at the wrong temperature.
These systems rarely appear on an IT asset list. They are installed by refrigeration and building-services contractors, kept online for remote support, and forgotten. Our founder’s IP Insights project has catalogued hundreds of them exposed across the UK, spanning several vendors. This tool lets you check your own ranges against that work in a few seconds, before someone else does. When you are ready to look at the whole of your external footprint, the External Exposure Report covers email, DNS, TLS and more in one pass.