Industrial Protocols on the Open Internet: A ZoomEye Measurement of Modbus and EtherNet/IP

Industrial control protocols were designed for isolated networks. ZoomEye measurements show how many of them are answering on the public internet, and where.

Method

Three product fingerprint queries were run against ZoomEye's combined dataset on 2026-09-20. Country facets were collected alongside each total.

app="Modbus"
app="EtherNet/IP"
app="Siemens S7"

Each query returns observed services presenting the corresponding fingerprint. A record is one observed service on one address. It is not a count of distinct facilities, and it does not indicate whether the device is vulnerable or whether it controls anything important.

Results

Modbus returned 9,820 records. The country distribution was heavily concentrated:
| Country | Records |
|---|---|
| Cyprus | 3,986 |
| United States | 916 |
| Sweden | 898 |
| Spain | 395 |
| Poland | 393 |
| Australia | 379 |
| France | 330 |
| Italy | 190 |
| Germany | 182 |
| Ukraine | 169 |
EtherNet/IP returned 585 records, distributed differently:
| Country | Records |
|---|---|
| United States | 199 |
| Japan | 77 |
| France | 40 |
| Singapore | 37 |
| South Africa | 29 |
| United Kingdom | 29 |
| Brazil | 27 |
| India | 25 |
| Sweden | 23 |
| Ireland | 21 |
Siemens S7 returned 173 records, concentrated in Europe:
| Country | Records |
|---|---|
| Germany | 90 |
| Spain | 13 |
| Japan | 8 |
| The Netherlands | 7 |
| France | 6 |
| Austria | 5 |
| Italy | 5 |
| United States | 5 |
| Belgium | 4 |
| Portugal | 4 |

Reading the distributions

The three protocols show three different geographic shapes, and the differences are worth examining rather than averaging away.
Modbus is dominated by a single country at roughly 41 percent of the total. That concentration is unusual and warrants caution in interpretation. A large cluster in one jurisdiction can reflect a single hosting provider, a research or honeypot deployment, or a scanning artifact rather than a genuine concentration of industrial control systems. The measurement identifies where to look; it does not explain why.
EtherNet/IP shows the most even distribution, with the United States at about 34 percent and a long tail across Europe and Asia. This is closer to what a widely deployed industrial protocol would look like if exposure were driven by ordinary operational decisions.
Siemens S7 is the most concentrated in a traditional industrial economy, with Germany at 52 percent. That shape is consistent with the protocol's deployment base rather than with any single hosting anomaly.

What the numbers do not say

Three limitations apply to all of the above.
Fingerprint matches are not vulnerability confirmations. A device answering on Modbus is not necessarily unpatched or misconfigured. It is reachable, which is a precondition for risk rather than the risk itself.
Protocol exposure is not process exposure. A reachable Modbus endpoint may serve a test rig, a building management system, or a simulator. The measurement cannot distinguish these from production control.
Geographic attribution is approximate. Country is derived from the observed address. Cloud hosting, VPN egress, and carrier-grade NAT all complicate the mapping between an address and a physical facility.

Why this measurement is still useful

Despite those caveats, the figures support a practical conclusion: industrial protocols are answering on the public internet in meaningful numbers, and the exposure is not confined to a single region.
For an organization operating industrial systems, the value of the measurement is comparative. Running the same queries and comparing the results against your own asset inventory answers a question that internal scanning cannot: whether any of your control infrastructure is visible to someone who has no authorized path into your network.
The remediation priority follows from that comparison. An endpoint that appears in public measurement data and in your inventory is a confirmed exposure. An endpoint that appears in measurement data but not in inventory is an unknown asset, which is a more serious problem.

A note on protocol design

Modbus, EtherNet/IP, and S7 all predate the assumption that their networks would be reachable from the internet. They carry no native authentication or encryption in their base forms. That is not a flaw to be patched; it is a design constraint that has to be managed through network architecture.
The measurement data shows that this constraint is not always being managed. The number of industrial protocol endpoints answering on public addresses is the evidence.

References

• ZoomEye, fingerprint query app="Modbus", combined dataset, collected 2026-09-20. Total: 9,820 records, with country facet distribution.
• ZoomEye, fingerprint query app="EtherNet/IP", combined dataset, collected 2026-09-20. Total: 585 records, with country facet distribution.
• ZoomEye, fingerprint query app="Siemens S7", combined dataset, collected 2026-09-20. Total: 173 records, with country facet distribution.
• CISA, ICS advisory guidance on minimizing network exposure of control system devices. https://www.cisa.gov/news-events/ics-advisories