There are only 4 billion IPV4 addresses. Just iterate port 5900 until you get a response, bam, VNC server.

Shodan has been keeping track of publicly accessible control systems for several years now and you can use the search engine to identify them. As a starting point check out: https://www.shodan.io/explore/category/industrial-control-sy...

Shodan.io is pretty good index of open ports on the internet

another, newer alternative is https://github.com/robertdavidgraham/masscan

note that doing this is a very good way to get angry letters from your ISP

Look up Zmap