What the EU's Internet Looks Like From the Outside: A Shodan Exposure Research Paper Across 14 Protocols

Abstract

This paper presents a visibility analysis of publicly reachable network services across all 27 European Union member states, conducted between March 1 and March 7, 2026. Using Shodan indexed data, we examined 14 protocols spanning legacy remote access, relational and NoSQL databases, analytics infrastructure, remote desktop protocols, and industrial control systems.

Total observable exposure across all 14 protocols exceeds 2.85 million publicly reachable services within the EU alone. This research does not constitute a vulnerability assessment. No systems were exploited or accessed beyond what they present publicly. The purpose is to quantify and contextualise the EU's externally visible attack surface.

Important Limitations and Scope Boundaries

Shodan Does Not See Everything

Shodan is comprehensive but has meaningful blind spots. Not every internet-connected device is indexed. The figures in this paper are conservative floor estimates. The actual number of publicly reachable services is likely higher than what Shodan indexes.

Port Does Not Guarantee Protocol

Not every service responding on a given port is the expected protocol. Where fingerprinting confidence is high we note confirmed instance counts. Where it is low we caveat accordingly.

Exposed Does Not Mean Vulnerable

A service being publicly reachable does not automatically mean it is exploitable or misconfigured. Many organisations legitimately expose services with appropriate controls in place. Exposure is a precondition for attack, not an attack itself. What exposure does is increase the number of entities that can attempt to interact with your service. Best practices matter precisely because the gap between exposed and properly hardened versus exposed and misconfigured is the entire difference between a non-event and a critical incident.

Methodology

Research period: March 1, 2026 to March 7, 2026

Scope: All 27 European Union member states

AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE

Data source: Shodan indexed visibility data. All results reflect observable exposure only.

The Full Picture at a Glance

Country Exposure Overview

The table below shows each EU member state's exposure across all 14 protocols. Figures represent Shodan-indexed services on the associated port at the time of collection.

*Data collected via Shodan across all 27 EU member states. Research period: March 1, 2026 to March 7, 2026. All queries represent visibility snapshots only and do not constitute exploitation attempts or vulnerability assessments. Not every service on a given port is confirmed to be the associated protocol. Fingerprinting is based on banner data and Shodan indexing methodology. Figures represent conservative floor estimates. Actual exposure may be higher than indexed values.*

Protocol Analysis

Cross-Protocol Patterns

Germany leads raw exposure across nearly every protocol in this report. The Netherlands and France consistently rank second and third. This reflects infrastructure concentration more than security posture.

Several services in this report can be fully compromised without any exploit. They require only network access and a default or absent configuration. Redis allows RCE via CONFIG and SAVE on unauthenticated instances. Docker API allows full host compromise via privileged container creation. MongoDB pre-3.x allowed full database access without credentials. Elasticsearch pre-6.8 allowed unauthenticated index access. Modbus has no authentication by design.

Recommendations for Defenders

Know What You Expose

Run your own Shodan queries against your registered IP ranges and ASNs before an attacker does. If Shodan can see a service, every automated scanner targeting the internet can see it too. What you find may be surprising. Shadow IT, forgotten test environments, infrastructure inherited through acquisitions, and cloud misconfiguration are common sources of unexpected exposure.

Prioritise by Consequence, Not by Volume

FTP has the highest raw numbers in this dataset but is not necessarily the most urgent remediation target for every organisation. An unauthenticated Redis instance or an exposed Docker API is a more immediate and higher-severity issue despite lower volume across the dataset as a whole. Prioritise based on what an attacker can do with access, not simply on how many services are exposed globally.

Segment Networks Aggressively

Databases, industrial controllers, analytics infrastructure, and internal services should never be reachable from the public internet. Private subnets, VLANs, and firewall allowlisting are not optional security controls. They are baseline architecture decisions that should be made before any service is deployed.

Treat Legacy Systems as Multiplied Risk

Windows XP on Telnet. MySQL 4.x. SQL Server 2008. Modbus PLCs with no authentication path forward. These systems cannot be patched into an acceptable security state. The only viable controls are isolation from internet access, active network monitoring, and planned replacement. Exposure combined with an unsupported software version creates compounded risk that cannot be addressed through configuration hardening alone.

Stop Relying on Obscurity

Non-standard ports do not provide meaningful protection in 2026. Shodan and similar tools scan all 65,535 TCP ports. Moving a service to a non-standard port reduces its appearance in protocol-specific searches but does not prevent discovery by tools that scan broadly. Reduced visibility in one tool does not mean reduced exposure. It means reduced awareness on your own part.

Monitor Continuously

Internet exposure is not a static state. New services are deployed. Firewall rules change. Container environments spin up and expose ports. Cloud configurations drift away from intended baselines. Continuous scanning of your own perimeter from the outside, using the same tools and techniques that attackers use, is the only reliable way to maintain an accurate picture of what you actually expose to the internet.

Conclusions

Across 14 protocols and all 27 EU member states, we identified approximately 2.85 million publicly reachable services carrying meaningful security context.

The exposure documented in this paper is not hidden. It is visible to anyone with a Shodan account and a list of IP ranges to query. That visibility is symmetric. It is available to security teams and attackers alike.

Exposed does not mean compromised. Best practices matter. A publicly reachable PostgreSQL instance with properly configured authentication, TLS enforcement, and tight access rules is a fundamentally different risk profile than one with trust authentication and no network controls. The exposure figures quantify the surface area. What lives behind each port determines the actual risk.

The question is not whether your infrastructure appears in data like this. The question is whether you know it does, and whether you have done enough to ensure that reachability alone is not sufficient for compromise.