The scoreboard: every grid and building protocol answers the open internet. 27k Modbus, 12k BACnet, 5.6k S7, 1.9k IEC-104 grid links, 408 PLC programming ports. These are not ports that should be reachable. tag:ics -tag:honeypot #shodansafari

CODESYS V2 PLCs speak their programming protocol with no authentication: runtime version, OS, even Windows CE, straight from the banner. 408 open on port 1200. port:1200 tag:ics -tag:honeypot #shodansafari

Inside that family: EIG power meters on plain HTTP serving live per-phase volts, amps and frequency - max/min history going back to 2016. No login. "Server: EIG Embedded Web Server" port:80 -tag:honeypot #shodansafari

The biggest ICS fingerprint on Shodan isn't a PLC. It's one power-meter vendor's embedded web server: 191,694 endpoints, on every continent. "Server: EIG Embedded Web Server" "200 Document follows" -tag:honeypot #shodansafari

EtherNet/IP controllers publish their product name, vendor and serial number to anyone who connects - no authentication. 1,717 hosts, 1,454 of them Allen-Bradley PLCs. port:44818 tag:ics -tag:honeypot #shodansafari

DNP3 outstations on the North American grid answer link-layer polls from anyone: source, destination and control codes come back in the clear. 623 endpoints on port 20000. port:20000 tag:ics -tag:honeypot #shodansafari

Tridium Niagara stations leak their own names over the Fox protocol — one belongs to a chemicals multinational — on Windows 7 and QNX 6. The station name is the first thing an attacker gets. product:"Niagara Fox" port:1911 -tag:honeypot #shodansafari

5,625 Siemens S7 CPUs answer the open internet with module type, firmware version and serial number — device identification with zero authentication. A target list, self-served. port:102 tag:ics -tag:honeypot #shodansafari

Grid telecontrol protocol IEC-104 is talking on the public internet: 1,224 endpoints in one country alone stream live measurement frames to anyone who connects. No VPN, no allowlist. port:2404 tag:ics -tag:honeypot #shodansafari

Nice warm day today

Aye it is. It's on my to-do I already have adbs setup

Isak is a lazy bastard

A SolaX solar dashboard showing today's PV production, battery state and grid export - wide open on the open internet. http.title:"Solax" -tag:honeypot #shodansafari

27,057 FTP servers still accept anonymous login and list their command set to anyone who asks. "230 Login successful." port:21 -tag:honeypot #shodansafari

153,875 SMB servers report "Authentication: disabled" - shares visible, names withheld here. "Authentication: disabled" port:445 -tag:honeypot #shodansafari

GoodWe solar inverters driving full Promotic SCADA pages: live power flows, boiler temps, battery stats - no login required. http.title:"GoodWe" -tag:honeypot #shodansafari

231 fluidd 3D-printer dashboards are wide open - live nozzle temps, job queue, and the printer's own camera feed. http.title:"Fluidd" -tag:honeypot #shodansafari

HikCentral Professional - a video-management server for camera fleets - announces itself on BACnet UDP 47808. 476 found. "HikCentral" port:47808 -tag:honeypot #shodansafari

Schneider Modicon M241 PLCs hand out CPU model and firmware version over unauthenticated Modbus TCP. 409 controllers. "TM241" port:502 -tag:honeypot #shodansafari