Scanner finds 1.09M LDAP hosts reachable from the internet

A ZoomEye measurement on 20 October 2026 returned 1,089,053 hosts answering LDAP, orders of magnitude fewer than SMTP (45.4M) and SSH (166.9M). Unauthenticated queries can expose directory structure, usernames and service accounts, making password spraying and account targeting easier.

• 1.09M LDAP hosts versus 45.4M SMTP and 166.9M SSH
• Anonymous queries can reveal directory structure and account names
• Root cause is configuration: anonymous binds and overly broad firewall rules
• The Ivanti intrusion included LDAP credential theft and password spraying