ICS Tracker
· ICS & OT Exposure Intelligence
v2.0
ICS & OT Exposure Intelligence
How ICS Tracker finds the internet's
exposed critical infrastructure
A 90-second look under the hood — from a raw internet scan to a searchable map of exposed industrial devices.
The problem
Industrial systems were never meant
to face the open internet
PLCs, HMIs and SCADA controllers run power grids, water plants and factories — yet thousands sit directly reachable online.
Step 1 · Scan
We probe the entire IPv4 internet
Not by following web links — by sending packets to every address and every industrial port, listening for control-system protocols.
ModbusDNP3S7comm
BACnetEtherNet/IPIEC-104
Step 2 · Fingerprint
Every responsive host becomes a profile
Our crawler waits for a valid ICS protocol response. Once received, it harvests data from every exposed web application — plus SSL certificates and HTML source.
host 198.51.100.42 ● RESPONDING
protocolModbus/TCP · 502
deviceSchneider M340 PLC
ssl_certCN=hmi.local · self-signed
bannerFW v2.7 · uptime 412d
Step 3 · Enrich
Then we add context
Geolocation, network owner (ASN) and device classification turn a raw IP into actionable intelligence.
📍 Frankfurt, DE
🏢 AS3320 Deutsche Telekom
🏷️ Water Treatment
Step 4 · Search
All of it, instantly searchable
Analysts query billions of data points with precise operators — and browse exposed HMIs in seconds.
🔍 protocol:modbus country:DE device:plc
198.51.100.42Schneider M340 · :502EXPOSED
203.0.113.15Siemens S7-1200 · :102EXPOSED
192.0.2.88Allen-Bradley · :44818EXPOSED
The outcome
See your exposure before attackers do
Security teams discover, monitor and shrink their internet-facing attack surface across critical infrastructure.
IPv4FULL INTERNET SCAN
CUSTOMICS PROTOCOL R&D
REAL-TIMEDATA UPDATES
ICS Tracker
ICS & OT Exposure Intelligence — discover and analyze internet-exposed assets with SSL, service and geolocation data.
icstracker.io