ICS Tracker · ICS & OT Exposure Intelligence v2.0
ICS & OT Exposure Intelligence

How ICS Tracker finds the internet's
exposed critical infrastructure

A 90-second look under the hood — from a raw internet scan to a searchable map of exposed industrial devices.

The problem

Industrial systems were never meant
to face the open internet

PLCs, HMIs and SCADA controllers run power grids, water plants and factories — yet thousands sit directly reachable online.

PLC
EXPOSED
HMI
EXPOSED
Power
EXPOSED
Water
EXPOSED
Step 1 · Scan

We probe the entire IPv4 internet

Not by following web links — by sending packets to every address and every industrial port, listening for control-system protocols.

ModbusDNP3S7comm BACnetEtherNet/IPIEC-104
Step 2 · Fingerprint

Every responsive host becomes a profile

Our crawler waits for a valid ICS protocol response. Once received, it harvests data from every exposed web application — plus SSL certificates and HTML source.

host 198.51.100.42 ● RESPONDING
protocolModbus/TCP · 502
deviceSchneider M340 PLC
ssl_certCN=hmi.local · self-signed
bannerFW v2.7 · uptime 412d
Step 3 · Enrich

Then we add context

Geolocation, network owner (ASN) and device classification turn a raw IP into actionable intelligence.

📍 Frankfurt, DE 🏢 AS3320 Deutsche Telekom 🏷️ Water Treatment
Step 4 · Search

All of it, instantly searchable

Analysts query billions of data points with precise operators — and browse exposed HMIs in seconds.

198.51.100.42Schneider M340 · :502EXPOSED
203.0.113.15Siemens S7-1200 · :102EXPOSED
192.0.2.88Allen-Bradley · :44818EXPOSED
The outcome

See your exposure before attackers do

Security teams discover, monitor and shrink their internet-facing attack surface across critical infrastructure.

IPv4FULL INTERNET SCAN
CUSTOMICS PROTOCOL R&D
REAL-TIMEDATA UPDATES

ICS Tracker

ICS & OT Exposure Intelligence — discover and analyze internet-exposed assets with SSL, service and geolocation data.

icstracker.io
0:00 / 1:24