LEGACY: Accessible Modbus Report

LAST UPDATED: 2022-03-21

LEGACY REPORT

Report discontinued. Replaced by: Accessible ICS Report.

This report contains a list of devices responding to Modbus queries sent to port 502/TCP. Modbus is a data communications protocol developed for industrial devices (or “industrial IoT”). It is unlikely that these types of devices need to be accessible in any form to queries from the Internet, so unless you are running a honeypot you are strongly advised to act immediately and block access.

For more information on our scanning efforts, check out our Internet scanning summary page.

This report currently only has an IPv4 version.

Filenames: scan_modbus

Fields

  • timestamp
    Timestamp when the IP was seen in UTC+0
  • ip
    IP of the detected device
  • protocol
    Protocol of the response
  • port
    Port response was received from
  • hostname
    Hostname of the device (may be from reverse DNS)
  • tag
    Tag, always set to modbus
  • asn
    AS of the detected device
  • geo
    Country of the detected device
  • region
    Region of the detected device
  • city
    City of the detected device
  • naics
    North American Industry Classification System Code
  • sic
    Standard Industrial Classification System Code
  • response_length
    length of the base64 decoded raw response
  • unit_id
    ID of the unit
  • vendor
    Vendor name of device
  • revision
    Version number of device
  • product_code
    Name of the device
  • function_code
    RTU Function code
  • conformity_level
    Level of authentication support
  • object_count
    Number of objects in the response
  • response_length
    Length of the base64 decoded raw response
  • raw_response
    Base64 encoded raw response
  • sector
    Sector of the IP in question

Sample

"timestamp","ip","protocol","port","hostname","tag","asn","geo","region","city","naics","sic","unit_id","vendor","revision","product_code","function_code","conformity_level","object_count","response_length","raw_response","sector"
"2022-02-17 00:09:28","128.65.xx.xx","tcp",502,,"modbus",42772,"BY","MINSKAJA OBLAST'","BINKOVCY",,,0,"COPALP","8.6.131128","T5",43,1,3,32,"DgEBAAADAAZDT1BBTFABAlQ1Ago4LjYuMTMxMTI4",
"2022-02-17 00:09:28","166.149.xx.xx","tcp",502,"xx.myvzw.com","modbus",22394,"US","PENNSYLVANIA","DOYLESTOWN",517312,,0,"ABB","V2.8.1,2018-12-13",37,43,130,3,254,"DgGCAAADAANBQkIBAjM3AhFWMi44LjEsMjAxOC0xMi0xMw==",
"2022-02-17 00:09:28","123.128.xx.xx","tcp",502,,"modbus",4837,"CN","SHANDONG SHENG","JINAN",517311,,0,"Rockwell Automation Allen-Bradley","07.0B",141,43,1,3,55,"DgEBAAADACFSb2Nrd2VsbCBBdXRvbWF0aW9uIEFsbGVuLUJyYWRsZXkBAzE0MQIFMDcuMEI=",
"2022-02-17 00:09:29","185.71.xx.xx","tcp",502,,"modbus",29286,"TR","SANLIURFA","ESER",,,0,"Schneider Electric","v2.6","BMX P34 2020",43,129,3,50,"DgGBAAADABRTY2huZWlkZXIgRWxlY3RyaWMgIAEMQk1YIFAzNCAyMDIwAgR2Mi42",
"2022-02-17 00:09:30","81.224.xx.xx","tcp",502,"xx.sore.bredband.telia.com","modbus",3301,"SE","VARMLANDS LAN","SAFFLE",517312,,0,"AB Regin",,,43,130,1,18,"DgGC/wEBAAhBQiBSZWdpbg==",
"2022-02-17 00:09:30","90.117.xx.xx","tcp",502,"90-117-xx.mobile.abo.orange.fr","modbus",3215,"FR","BOURGOGNE-FRANCHE-COMTE","CHASSIGNY-SOUS-DUN",517312,,0,"Schneider Electric","V2.30","BMX NOE 0100",43,129,3,49,"DgGBAAADABJTY2huZWlkZXIgRWxlY3RyaWMBDEJNWCBOT0UgMDEwMAIFVjIuMzA=",
"2022-02-17 00:09:30","46.97.xx.xx","tcp",502,,"modbus",12302,"RO","CONSTANTA","HORIA",,,0,"Schneider Electric","V04.00.02.52","TM241CE40T_U",43,129,3,56,"DgGBAAADABJTY2huZWlkZXIgRWxlY3RyaWMBDFRNMjQxQ0U0MFRfVQIMVjA0LjAwLjAyLjUy",
"2022-02-17 00:09:30","166.168.xx.xx","tcp",502,"xx.myvzw.com","modbus",22394,"US","PENNSYLVANIA","DOYLESTOWN",517312,,0,"ABB","V2.7.2,2017-12-05",37,43,130,3,254,"DgGCAAADAANBQkIBAjM3AhFWMi43LjIsMjAxNy0xMi0wNQ==",
"2022-02-17 00:09:30","213.192.xx.xx","tcp",502,,"modbus",16019,"CZ","KRALOVEHRADECKY KRAJ","MORAVSKE PREDMESTI",517312,,0,"Solare Datensysteme GmbH","V1.00","xxxxxx",43,2,3,49,"DgECAAADABhTb2xhcmUgRGF0ZW5zeXN0ZW1lIEdtYkgBBnh4eHh4eAIFVjEuMDA=",
"2022-02-17 00:09:30","88.149.xx.xx","tcp",502,"88-149-xx.static.eolo.it","modbus",35612,"IT","VARESE","CASSANO MAGNAGO",517311,,0,"Schneider Electric","V1.0","TM221CE24T",43,129,3,46,"DgGBAAADABJTY2huZWlkZXIgRWxlY3RyaWMBClRNMjIxQ0UyNFQCBFYxLjA=",

Our 126 Report Types

« Back to Network Reporting