Summing ZoomEye counts for ports 102, 502 and 44818 double-counts hosts and mixes risk profiles

The author argues that a single exposure figure is usually wrong for the question being asked ^[1]. A ZoomEye port filter returns the indexed results matching that port at the time of collection, and this set was collected on 22 September 2026 ^[3][2]. The write-up's text gives the ranking of the three counts but not the totals.

The ranking follows implementation breadth. Modbus TCP on 502 has the largest count, and the author says that breadth of implementation is the reason it exceeds 102 ^[16]. Modbus shows up in the firmware of cheap devices, in gateways that translate serial Modbus into TCP, and as software on general-purpose hardware ^[18]. S7comm on 102 sits in the middle. Siemens and a limited set of compatible products implement it, but the SIMATIC installed base is large and long-lived ^[19]. EtherNet/IP on 44818 is smallest, and the author calls that consistent with a narrower vendor ecosystem and a more specialised device population ^[17].

Summing the counts breaks as soon as one host answers twice. A gateway can expose Modbus TCP and EtherNet/IP together, so a sum counts it twice ^[8]. The populations also carry different risk. An exposed Modbus gateway on a building management network is a different case from an exposed S7 controller on a production line ^[9]. And the counts are indexed results, not unique devices or organisations, with coverage that varies by protocol, region and how a service answers a probe ^[10].

Double-counting pushes a total up ^[8]. A protocol that fails to answer a standard probe pushes it down, because it will be undercounted ^[14]. In our view, a global total transfers to one estate only if that estate's protocol mix matches the global mix and the index sees its hosts the way it sees everyone else's.

After the query comes identification. According to the write-up, a 502 result on a corporate network is usually a misconfigured gateway, and a 102 result on a production network is a different risk ^[12]. Some organisations expose industrial protocols on purpose for remote maintenance, and the author says that choice should be documented ^[13].

The most important caveat concerns port 102. A host answering there is a candidate for S7comm, not a confirmed Siemens controller, and confirmation takes a different method from the port query ^[15]. The base S7comm protocol has historically had no authentication ^[5]. In our view a port 102 list is a worklist until that second method has run.