The Numbers
A public internet index query for country:LK returned 20,866 indexed results as of August 26, 2026. Each result represents a host on a Sri Lankan IP with at least one port observed open at the time of indexing. Servers, routers, cameras, databases.
This is post one of twenty. Each subsequent post covers a specific category: government systems, open databases, exposed cameras, hospitals, banks. This one covers the aggregate.
Ports
Port 80 leads with 9,134 hosts exposing an HTTP service. Port 443 (HTTPS) follows at 6,221. An open port 80 establishes that HTTP is accessible. It does not rule out encryption elsewhere on the host, but plaintext HTTP exposure at this scale warrants attention.
Port 23 is the one that stands out. Telnet on 1,422 hosts. Telnet was replaced by SSH in the 1990s. It transmits credentials and session data in plaintext, making any observer on the network path capable of capturing them. Exposed Telnet services are a well-documented target for automated scanning across the public internet.
Geographic Spread
Colombo accounts for 18,209 of 20,866 results, or 87%. The rest of the country is largely absent from the index. Colombo is where the data centers, ISP infrastructure, and government ministries are concentrated.
* "Internet Service Provider in Sri Lanka" appears as two variants in the public index, combined total shown
What Is Running
Apache and nginx lead as expected. Third place is Hikvision IP cameras at 1,373 instances. Camera firmware is the third most common product on Sri Lanka's public internet. Hikvision devices have a well-documented history of critical CVEs and ship with default credentials that are widely published.
TLS Versions
TLSv1.2 and TLSv1.3 are current. Everything below is deprecated. SSLv3 was broken by the POODLE attack in 2014 and disabled by every major browser years ago.
4,324 hosts are running deprecated TLS. SSLv3 and TLSv1 are deprecated protocols with known cryptographic weaknesses. Browsers have disabled support for these versions by default. The servers are still advertising them anyway.
Auto-Tags
The public index auto-tags hosts based on observed behavior. Three tags define the picture.
Self-signed (1,869): No trusted certificate authority. Encryption may still be in use, but without third-party identity validation, browsers cannot verify who they are talking to and will warn users accordingly. The servers stay up.
End-of-life product (1,384): Software the vendor stopped patching. Any vulnerability found today may remain unpatched without vendor support. 1,384 hosts in this state, internet-facing.
Open directories (40): Directory listing enabled. Anyone can browse the server's file index in a browser. This may expose files such as backups, configuration files, or other unintended content.
CVE Associations from Banner Data
The public index cross-references host banners against known CVEs. These associations are based on version and banner matching only and indicate potential exposure, not confirmed exploitability.
Heartbleed was disclosed in 2014. It can read 64KB of server memory per request, with the potential to expose sensitive memory contents including cryptographic material. Six Sri Lankan hosts have a banner/version match for this CVE. BlueKeep (2019) is a critical unauthenticated RDP vulnerability. Six hosts match. A CVE association from banner data does not establish that the vulnerable code path is present or that exploitation would succeed.
Notable Findings
Government and critical services visible in the indexed results:
Summary
20,866 devices. Legacy protocols. End-of-life software. CVE associations involving vulnerabilities dating back to 2014. Surveillance cameras as the third most common product on the public internet. This is all OSINT, collected in an afternoon. If this is visible to a researcher, it is visible to threat actors. The difference is threat actors are not writing about it.
The next 19 posts go deeper into each category: government portals, open databases, cameras, banks, hospitals, universities. The editorial rule for the entire series is: public data only, patterns not targets. No IP addresses, no hostnames, no information that functions as a reconnaissance aid.