Security1 hOctober 28, 2026, 04:00

ZoomEye finds 2,188,380 exposed CoAP hosts on the internet

A ZoomEye query for service="coap" returned 2,188,380 matches on 28 October 2026. Many constrained devices expose their resource list via /.well-known/core without credentials, and CoAP itself has no built-in authentication.

DEV Community

Open source

ZoomEye finds 2,188,380 exposed CoAP hosts on the internet

ZoomEye counted 2,188,380 hosts speaking CoAP as of 28 October 2026
CoAP runs on UDP 5683 with no handshake or banner; DTLS variant uses 5684
The /.well-known/core endpoint lists device resources without credentials
CoAP has no built-in auth; OSCORE and DTLS are optional and need provisioning

#ZoomEye#CoAP

Scanner finds 1.09M LDAP hosts reachable from the internet

Security

ZoomEye finds 116,010 exposed Gitea instances on the public internet

Security

ZoomEye finds 1,160,264 Mosquitto MQTT brokers exposed to the internet

Security

ZoomEye finds 2,188,380 exposed CoAP hosts on the internet

Scanner finds 1.09M LDAP hosts reachable from the internet

ZoomEye finds 116,010 exposed Gitea instances on the public internet

ZoomEye finds 1,160,264 Mosquitto MQTT brokers exposed to the internet

ZoomEye finds 14,061 exposed Graylog servers on the internet