At Censys, our goal is to capture an accurate representation of the Internet at any given time. However, not only is the Internet large, but our investigations and prior research show that many of the services on the Internet do not respond on their standard port. While you would expect Modbus to be found only on port 502, the reality is that there is a plethora of Modbus on other, non-standard ports.

Our research team put together a new blog about how we use independent measurement and research to verify where to scan in a more focused manner, concentrating on ICS protocols as a case study. You can check it out here.