Look up Zmap

There are only 4 billion IPV4 addresses. Just iterate port 5900 until you get a response, bam, VNC server.

Shodan.io is pretty good index of open ports on the internet

Shodan has been keeping track of publicly accessible control systems for several years now and you can use the search engine to identify them. As a starting point check out: https://www.shodan.io/explore/category/industrial-control-sy...

another, newer alternative is https://github.com/robertdavidgraham/masscan

note that doing this is a very good way to get angry letters from your ISP