DEV Community

jeffrey
jeffrey

Posted on

Two Engines, Two Numbers: Why 2,991 and 260 Describe Different Internets

#security #zoomeye #measurement #danfoss

Two Engines, Two Numbers: Why 2,991 and 260 Describe Different Internets

Two credible measurements of the same equipment class can disagree by more than a factor of ten and neither is lying. When Censys reported 2,991 internet-exposed Danfoss StoreView control panels on 11 October 2026 and a ZoomEye header query returned 260 global assets on 22 October 2026, the reflex is to ask which one is right. The more useful question is what each instrument was built to see.

The two observations, stated precisely

Censys described a scan performed against its own telemetry on 11 October 2026, the day a cyber-attack hit cooling systems at hundreds of French supermarkets. It counted 2,991 hosts with a Danfoss StoreView control panel, 1,825 of them, or 61%, in France. By 14 October the French figure was 537, a 71% fall, while the count outside France moved from 1,166 to 966.
The ZoomEye observation is a header match run on 22 October 2026 against a different index, eleven days after the attack and four days after the Censys panel count. http.header="Danfoss" returned 260 assets. Breaking it down, port="80" returned 120 and port="443" returned 132; is_ipv4=true returned 138 and is_domain=true returned 122; by country, the Netherlands returned 54, the United States 28, Germany 25 and France 1.

What separates the two figures

Four differences explain most of the gap, and none of them involves an error.
The first is the recognition method. Censys identifies a StoreView control panel, which means it has some way of confirming the interface itself. The ZoomEye query matches a response header containing the vendor name. A panel that does not emit that string, or emits it only on an authenticated page, is invisible to the header query and visible to the interface fingerprint. This is why app="Danfoss StoreView", app="StoreView" and product="Danfoss" all returned zero in ZoomEye: the fingerprint does not exist there, so the weaker but available signal had to carry the query.
The second is time. Between 11 and 14 October French operators removed panels from the internet at speed, and the Censys series shows that movement continuing. A measurement taken on 22 October is not comparable to one taken on 11 October, whatever the engine.
The third is the state of the population. After an incident, some assets are firewalled, some are powered down, some are re-addressed. A scan sees only the survivors of that process.
The fourth is the country result, which is the sharpest warning. One French asset against 54 Dutch, 28 American and 25 German assets does not mean France escaped. It means the header string is more common on assets outside France, and that the French population Censys counted exposed a different signature.

Why the disagreement is informative

A single number invites a wrong decision. A team told that 2,991 French refrigeration panels are exposed will treat the figure as a national fact. A team told that one is exposed will conclude the problem is elsewhere. Both would be reasoning from an instrument they had not characterised.
The disagreement also sets a ceiling on precision. If two recognised scanning services differ by a factor of eleven on a population of several thousand devices, then any claim about that population carried to three significant figures is decorative. The defensible statement is narrower: a substantial number of refrigeration controllers were reachable from the public internet before the attack, the count fell sharply afterwards, and each engine sees a different subset.
The 71% fall has the same structure. Censys observed it across all three version categories it tracked, including patched ones, and concluded that operators disconnected rather than patched. That inference comes from a single vendor's telemetry and has not been independently reproduced. It is a strong observation, not a proven characterisation of every site.

Using two engines without pretending they agree

Three practices follow for anyone measuring operational technology exposure.

  1. Record the instrument with the number. A count without the engine, the fingerprint, the exact query string and the timestamp cannot be compared with anything later, including your own earlier work.
  2. Never reconcile two sources by averaging. If a header query sees 260 and an interface fingerprint sees 2,991, the gap is a coverage statement. Averaging it produces a figure that describes neither.
  3. Use the disagreement to choose a follow-up. A large interface count with a small header count argues for checking the interface directly. A large header count with no interface match argues that the string appears on assets that are not the product. That third point is why the broad title queries matter as a control. title="Danfoss" returned 27,287 and title="StoreView" returned 17,384 on the same day. Neither is a device count. They show how easily a vendor name attaches to pages that have nothing to do with a controller.

What ZoomEye offers here

ZoomEye's value in this case is availability and repeatability. Anyone can re-run http.header="Danfoss", change the country, port or address class, and get a fresh number within seconds. For an organisation that owns refrigeration equipment, that ability to establish and re-check a baseline is worth more than a single authoritative figure.
ZoomEye does not replace an interface-level inventory, and the 260 figure does not supersede Censys' 2,991. The two answer different questions about the same fleet. Deciding which question matters, and writing down which engine answered it, is the part that no search engine can do for you.

References

Top comments (0)