athorion/exposure-report
EXPOSURE REPORT GERMANY · NON-INTRUSIVE

Exposure Report Germany

How exposed is Germany? A non-intrusive measurement of the country's externally visible attack surface - open services, remote access and databases on the open internet, and actively exploited vulnerabilities.

Get the PDF report ↓ Check my own domain - free → As of 30 Oct 2026
You have been unsubscribed. No more emails.
Exposed hosts
13,889
of 440,169 scanned German IPs
With a known vuln
48.9%
6,787 hosts
Actively exploited (KEV)
10.3%
1,434 hosts
With a critical finding
21.2%
2,950 hosts

Services that should never face the open internet

Remote access, file shares and databases belong behind a VPN or firewall. Every one of these is an immediate, attractive target.

RDP :3389
35 (0.3%)
SMB :445
20 (0.1%)
Telnet :23
6 (0%)
VNC :5900
10 (0.1%)
MySQL :3306
62 (0.4%)
PostgreSQL :5432
26 (0.2%)
Redis :6379
12 (0.1%)
Elasticsearch :9200
11 (0.1%)
MongoDB :27017
40 (0.3%)
Memcached :11211
9 (0.1%)
MS-SQL :1433
9 (0.1%)
FTP :21
125 (0.9%)

Exposed device categories

ICS / OT (industrial control)
42 (0.3%)
IoT devices
54 (0.4%)
Exposed databases
123 (0.9%)
RDP (remote desktop)
35 (0.3%)
Telnet (cleartext)
13 (0.1%)
SMB / file shares
23 (0.2%)

Most common open ports

HTTPS :443
76.1%
HTTP :80
61.8%
SSH :22
47.2%
SMTP :25
1.2%
FTP :21
0.9%
SMTPS :465
0.9%
IMAPS :993
0.9%
IMAP :143
0.9%
SMTP :587
0.8%
Port 5060 :5060
0.8%
POP3 :110
0.8%
POP3S :995
0.8%

Most common vulnerabilities

CVE-2026-35385
3,257 hosts
CVE-2024-6387
2,965 hosts
CVE-2026-106583
2,657 hosts
CVE-2026-106553
2,642 hosts
CVE-2026-106555
2,635 hosts
CVE-2026-35414
2,616 hosts
CVE-2026-59999
2,591 hosts
CVE-2026-60000
2,571 hosts
CVE-2008-3844
2,180 hosts
CVE-2026-60002
2,159 hosts
CVE-2026-3497
2,146 hosts
CVE-2023-51767
2,029 hosts

Get the full report as a PDF

The complete Exposure Report Germany, ready to share with your team or management - delivered to your inbox.

✓On its way - check your inbox for the report.
How it is measured
Fully non-intrusive internet measurement (TCP connect, TLS, HTTP headers, banners), the same technique internet-wide measurement services use. No exploits, no login attempts, no payloads. Aggregate figures only - no host-level data is published.
Where the numbers come from
From the Athorion internet-wide index, attributed to Germany via MaxMind GeoLite2 GeoIP. Vulnerabilities are matched version-based against CISA KEV and FIRST EPSS.

How does your own domain compare?

Enter your domain and we check your external attack surface - free, non-intrusive, no login - with concrete, prioritised steps.

Methodology: non-intrusive internet measurement + version-based CVE matching (CISA KEV / FIRST EPSS). Country attribution via MaxMind GeoLite2. Figures are aggregate counts across the German hosts in the Athorion index and will shift as the index grows. For information only.