Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesZoomEye results can show which industrial-protocol services and PLC-related fingerprints its index found, but they do not establish how many unique, operational, vulnerable controllers are exposed. A DEV Community article by kozhevniko reports six query totals from September 19, 2026; treat them as attributed, unverified matches—not a census or a vulnerability count.
What the reported ZoomEye counts show
The DEV Community article reports these ZoomEye query results, using sub_type=all and a page size of 1. The author says page size affected the returned records, not the matched total. The figures below are the article’s reported matches for its stated query date, September 19, 2026; the underlying results have not been independently reproduced.
As an Amazon Associate I earn from qualifying purchases.
| Reported query | Reported matches | What the query targets |
|---|---|---|
port="102" && service="iso-tsap" |
123,486 | Port 102 and the ISO-TSAP service classification, associated with S7 communications |
app="Siemens-SIMATIC-S7" |
6,906 | A Siemens SIMATIC S7 application fingerprint |
device="PLC" |
95,613 | A PLC device classification |
app="Modbus" |
9,812 | A Modbus application fingerprint |
port="502" && service="modbus" |
38,141 | Port 502 and the Modbus service classification |
port="44818" |
41,973 | Port 44818, commonly associated with EtherNet/IP |
These are different search definitions, not six partitions of one population. A port-and-service query can return a different set from an application or device fingerprint query. The totals may overlap, so do not add them together or treat them as interchangeable estimates of exposed PLCs.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat a search-engine match does—and does not—establish
A match means the search platform indexed a service or fingerprint that met the query under its collection and classification process. It is evidence of discoverability to that platform at some point, not proof that the result is a genuine production controller or that it is currently reachable in the same state.
- It does not establish device identity. A protocol or port match alone is not confirmation that an endpoint is a PLC.
- It does not establish exposure architecture. The result does not by itself show whether a gateway, firewall, proxy, or other control sits in front of a device.
- It does not establish vulnerability or impact. Reachability is not exploitability, and the reported counts are not counts of vulnerable or compromised systems.
There is also a timing issue in the account: its page displays “Posted on Sep 18,” while the query date it reports is September 19, 2026. That one-day discrepancy and the unverified underlying results mean the numbers should remain explicitly attributed to the article rather than presented as independently validated measurements.
Why exposure estimates depend on method
Different internet-measurement efforts can produce different totals because they define and validate devices differently. When assessing a count, check the platform and indexing date, query syntax, and whether the figure means matches, records retrieved, or unique IP addresses. Also ask what geographic and network coverage applies, and how the method handles duplicate results, honeypots, proxies, and stale or reassigned addresses.
Rank #2
- 1 PLC Controller 20 i/o; 12 DC Inputs, 8 Relay Outputs
- PLC Ladder Logic Software
- 1 USB Interface Cable
- Operation 24VDC, Bonus PLC ladder logic Training Course
- For Windows 10, at 32bit
The 2021 ICScope study illustrates why these distinctions matter: it extracted device information from banners collected by multiple search engines, filtered possible ICS honeypots, and associated the remaining device information with known vulnerabilities. For its December 2019–January 2020 measurement, the study reported coverage of more than 466,000 IPs and found one or more vulnerabilities in 49.58% of the internet-facing ICS devices it identified. That is a historical, study-specific result—not a current global prevalence rate and not a finding about the ZoomEye results above.
How to use scan results defensibly
For an organization responsible for industrial assets, a search result is a lead to investigate, not an asset record to accept uncritically. CISA’s Internet Exposure Reduction Guidance, published June 4, 2025, recommends routinely assessing internet-accessible assets. CISA also identifies specialized platforms such as Thingful, Censys, Shodan, and Shadowserver as possible visibility tools for internet-connected devices, including IIoT and ICS; it explicitly states that inclusion is not an endorsement.
- Limit discovery to authorized scope. Search only address space and systems you are authorized to assess.
- Reconcile findings. Compare matches with owned address space and a maintained asset inventory; investigate whether each result corresponds to a real, current asset.
- Validate the service and its exposure path. Establish what device or service is actually present and whether direct internet access is necessary. Do not infer operational role or vulnerability from a port label alone.
- Reduce unnecessary exposure. Remove direct public access where it is not required and put secure, monitored remote access behind a jump host.
- Harden and reassess. Change default passwords, patch supported systems, replace devices or software that no longer receive security support, enable MFA where possible—including at the jump host—and monitor ingress and egress traffic. Repeat the asset assessment routinely.
Which OT guidance to use
NIST SP 800-82 Rev. 3, published in September 2023, is the final guide cited here for operational technology security. NIST describes its purpose as: “This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.” It covers ICS, including PLCs, while accounting for those operational constraints.
A NIST planning note dated September 21, 2026 points to the initial public draft of Revision 4 and gives November 30, 2026 as the public-comment deadline. Treat Revision 4 as a draft unless and until a final revision is published; the planning note does not replace Rev. 3 as the final guide. CISA’s ICS Recommended Practices page is another official entry point for control-system security and mitigation references.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
