A ZoomEye measurement reported 9,820 internet-visible Modbus service records and 585 EtherNet/IP records on September 20, 2026. Those are fingerprint matches for services observed at individual IP addresses—not counts of vulnerable devices, production facilities, or compromised systems. The figures come from a community post and have not been independently reproduced from a primary ZoomEye export.
What the ZoomEye measurement reported
A community post by yutianle says it queried ZoomEye’s combined dataset on September 20, 2026, using the product fingerprints app="Modbus", app="EtherNet/IP", and app="Siemens S7". The post defines each record as one observed service on one address. Its reported counts and leading country facets are:
As an Amazon Associate I earn from qualifying purchases.
| Fingerprint | Reported records | Leading country facet | What the location indicates |
|---|---|---|---|
| Modbus | 9,820 | Cyprus: 3,986 records | Country inferred from observed IP addresses; not a verified facility location. |
| EtherNet/IP | 585 | United States: 199 records | Country inferred from observed IP addresses; not a verified facility location. |
| Siemens S7 | 173 | Germany: 90 records | Country inferred from observed IP addresses; not a verified facility location. |
All counts and country facets in the table are the post’s reported results, not independently validated totals. The post describes fingerprint matches in its combined dataset, rather than verified vulnerable devices or operating facilities. Read the reported ZoomEye measurement.
Recommended Free Tools
What a “record” does—and does not—count
A record represents one service observed on one address. It is not necessarily one unique device: an address may host multiple services, and address-level observations do not establish the number of distinct sites, organizations, or facilities. The reported totals also do not provide a denominator for all industrial devices or services.
#1 Best Overall
A fingerprint match supports a narrower conclusion: a service answered in a way ZoomEye associated with the named protocol at the observed address. It does not establish that the endpoint is vulnerable, that it controls a live process, or that an attacker has compromised it. The measurement cannot distinguish a production control device from a test rig, building-management system, simulator, or other endpoint.
Why the country facets need caution
The reported Cyprus Modbus cluster—3,986 records—is an especially large facet, but the post does not establish why it appears. Its author suggests hosting-provider infrastructure, research or honeypot systems, or scanning artifacts as possibilities. None is confirmed by the measurement.
Country attribution is based on observed IP addresses, not physical inspections of industrial sites. Cloud hosting, VPN egress, and carrier-grade NAT can separate an IP’s apparent location from the location of the equipment using a service. These facets are descriptive of the dataset and are not a sound way to rank countries by industrial exposure or risk. In particular, the Cyprus count does not show that Cyprus has the most exposed industrial facilities.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What protocol security options exist
Modbus and Modbus Security
Traditional Modbus TCP uses port 502. The Modbus Organization also specifies Modbus Security, which encapsulates Modbus packets in TLS and uses X.509v3 certificates for authentication and message-integrity protection; the specified port is 802. The organization’s specifications page lists traditional Modbus documentation and Modbus Security. Its description says the protocol protects communications by combining TLS with traditional Modbus.
EtherNet/IP and CIP Security
ODVA lists CIP Security as Volume 8 of its CIP Networks Library; its specification listing gives versions current as of April 2026. ODVA describes options including endpoint authentication, message integrity and authentication, and optional encryption. The capabilities are organized in profiles and depend on the product and deployment, so the existence of CIP Security does not mean every EtherNet/IP device supports or uses all of these protections. See the ODVA specification listing and ODVA’s CIP Security overview.
Protocol security extensions and base-protocol behavior are distinct. Operators need to verify the capabilities supported by a particular product and how they are configured; it is not accurate to assume either that every implementation lacks security options or that an extension is enabled on every endpoint.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How operators can use an apparent match
Treat public search results as leads for authorized asset validation, not as confirmed incident findings. Compare an observation with your organization’s asset inventory and investigate whether the address and service belong to you before taking action.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Best Value
- Confirm ownership. Establish whether the observed address is assigned to your organization or a provider acting on its behalf.
- Verify the service and device role. Confirm that the endpoint actually speaks the identified protocol, identify the product, and determine whether it is a production device, test system, simulator, or another service.
- Check the network path and intended reachability. Review firewalls, routing, NAT, and other relevant controls to determine how the service became publicly observable and whether that exposure is required.
- Investigate discrepancies. A match in both the public observation and your authorized inventory is an externally visible asset to validate and address according to operational risk. A public result missing from the inventory may be an unknown asset and warrants investigation.
- Plan remediation with operational owners. Use network architecture and approved security capabilities for the specific products involved as part of a defense-in-depth plan. Do not treat encryption alone as a remedy for an endpoint that should not be publicly reachable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
