Investigating the Vast World of ICS Coverage: Part 2

Censys Research evaluated non-standard-port discovery for industrial control systems by applying a "port tweaking" method and full 65k-port scans to hosts labeled as ICS but lacking protocol fingerprints. The experiments uncovered over 200 previously undetected ICS protocol instances (predominantly Modbus and Fox), and identified unexpected common ports for multiple protocols (for example Modbus on 552 and WDBRPC on 111), concluding that relying solely on standard ports misses substantial ICS presence and recommending broader, methodical scanning approaches to improve visibility.