Exposed Industrial Controllers: What ZoomEye Data Says About Internet-Facing PLCs

Industrial control systems were once assumed to be safely isolated from the internet. Internet-wide measurement tells a different story. By querying ZoomEye for the protocols that industrial equipment speaks, we can see how many controllers are directly reachable from the public internet, and what that exposure means for the organizations running them.

The problem and why it matters

In August 2026, a joint advisory from five U.S. federal agencies warned that attackers are using AI-generated scripts to target Siemens S7 PLCs, scanning for exposed controllers and communicating over the S7comm protocol on port 102. The advisory did not describe a new vulnerability; it described an exposure problem. Measuring that exposure is the first step toward reducing it.

Context and method

The figures below come from ZoomEye queries run on 2026-09-19 with sub_type set to "all" and a page size of one, so the returned value is the matched total, not the number of records fetched. Each query targets a specific protocol or product fingerprint. These are point-in-time observations of internet-facing assets; they do not prove that any given device is vulnerable or exploitable, only that it is reachable and identifiable.

What the data shows

• port="102" && service="iso-tsap" returned 123,486 matches. This is the S7comm/ISO-TSAP service that Siemens S7 controllers use, and it is the exact port the advisory tells attackers to scan.
• app="Siemens-SIMATIC-S7" returned 6,906 matches, a narrower fingerprint of devices ZoomEye specifically identifies as Siemens S7.
• device="PLC" returned 95,613 matches, a broader category that includes controllers from multiple vendors.
• app="Modbus" returned 9,812 and port="502" && service="modbus" returned 38,141, reflecting the wide deployment of the Modbus protocol, which historically lacks authentication.
• port="44818" returned 41,973, the port associated with EtherNet/IP used by Rockwell Automation and other vendors. The gap between the broad protocol counts and the narrower product fingerprints is instructive. The port-level numbers describe how much industrial protocol traffic is reachable; the product-level numbers describe what can be positively identified. Both matter, because attackers scan by protocol and then fingerprint by product.

Interpretation and practical value

These numbers should not be read as a vulnerability count. A reachable controller is not necessarily an exploitable one, and many of these devices may sit behind additional controls. What the data does show is scale: the industrial protocol surface on the public internet is measured in tens of thousands of endpoints per protocol, which is more than enough for automated scanning to find targets.
The practical value of this kind of measurement is self-assessment. An organization can run the same queries against its own address space and compare the result to its asset inventory. Any controller that appears in an internet-wide scan but not in the inventory is an unknown exposure and an immediate priority.

Implications and next steps

• Remove industrial controllers from direct internet exposure. Port 102 and port 502 should not be reachable from the public internet.
• Use continuous measurement as a discovery tool. Reconcile scan results against the asset inventory regularly.
• Segment OT from IT following IEC 62443 principles, so that a reachable device is not automatically a bridge into the production network.
• Prioritize legacy devices. Older controllers that cannot be patched should be isolated or scheduled for replacement. ZoomEye turns the same scanning technique attackers use into a defensive inventory tool. The measurement is not the fix, but it makes the problem visible and measurable, which is where any serious OT security program begins.

References

• ZoomEye queries executed 2026-09-19 (sub_type=all, pagesize=1): port="102" && service="iso-tsap"; app="Siemens-SIMATIC-S7"; device="PLC"; app="Modbus"; port="502" && service="modbus"; port="44818".
• Joint advisory AA26-231A (NSA, CISA, FBI, DOE, EPA), 2026-08-19.
• MITRE ATT&CK for ICS, Remote System Discovery (T0846).