← Back to OT Intelligence
Modbus on Cloud: Alibaba Infrastructure Running Industrial Protocol Services
Anomaly Score: 7/10
· 13 August 2026 · Automated OSINT Scan
Executive Summary
An automated global ICS anomaly scan using the Shodan Developer API has identified 26 anomalies across four targeted query blocks. The highest-scoring finding (7/10) reveals a Jetty web server responding on Modbus port 502 within Alibaba Cloud (Aliyun) infrastructure in Shenzhen, China. A secondary anomaly detected Microsoft IIS httpd answering on Siemens S7 port 102 in Iran.
These findings highlight a growing and under-discussed problem: industrial protocol ports hosting consumer IT services on cloud infrastructure.
The Top Finding: Jetty on Modbus
Query: ics_hmis (port:502, country:CN)
Location: Shenzhen, China
Port: 502 (Modbus/TCP)
Product: Jetty (Java HTTP server)
Organization: Aliyun Computing Co.
Weirdness Score: 7/10
Indicators:
- Consumer/IT service on industrial port 502: Jetty
- ICS port 502 on cloud provider: Alibaba
- ICS device on cloud provider: Alibaba
This is not a PLC running Modbus. This is a Jetty web application server listening on port 502 — the well-known port for Modbus/TCP, one of the most widely deployed industrial control protocols in the world.
Why This Matters
Three distinct threat vectors converge in this single finding:
- Protocol confusion attacks: If network segmentation or firewall rules assume port 502 carries Modbus traffic, a Jetty server on that port could bypass inspection rules or trigger false negatives in OT monitoring systems.
- Cloud-based OT testing exposure: Alibaba Cloud is commonly used for testing and development. A Modbus port running a web service suggests either an exposed test environment or a misconfigured deployment that could serve as a pivot point.
- Industrial reconnaissance surface: Threat actors scanning for Modbus devices will find this host. Even though it runs Jetty, its presence in Shodan on port 502 means it appears in any query for "ICS devices in China."
Secondary Finding: IIS on Siemens S7 Port
Query: unauth_ics (port:102, country:IR)
Location: Shiraz, Iran
Port: 102 (Siemens S7 / ISO-on-TCP)
Product: Microsoft IIS httpd
Weirdness Score: 5/10
Indicators:
- Consumer/IT service on industrial port 102: IIS
- ICS device on cloud provider: Microsoft
The same pattern repeats: an industrial control protocol port (102, used by Siemens S7 PLCs) hosting a conventional web server (IIS). This was found in Iran, a country with a history of state-level ICS targeting.
Notable: Stockfish on Modbus
Query: ics_hmis (port:502, country:CN)
Location: Heyuan, China
Port: 502 (Modbus/TCP)
Product: Stockfish chess engine
Weirdness Score: 4/10
Yes, the open-source chess engine Stockfish was detected on Modbus port 502 — also on Alibaba Cloud. This is almost certainly a testing artifact, but its presence on an industrial protocol port in a search engine index demonstrates how cloud test environments pollute the ICS threat landscape.
Full Scan Results
| Query | Filter | Results | Anomalies |
|---|
ics_hmis | port:502 country:CN | 20 | Multiple cloud artifacts |
unauth_ics | port:102 country:IR | 20 | IIS on S7 port |
geopolitical_ics | port:2404 country:RU | 20 | IEC-104 in Russia |
dnp3_us_east | port:20000 country:US | 20 | DNP3 domestic exposure |
Total: 80 results scanned, 26 anomalies flagged across 4 queries.
Defender Recommendations
Immediate (0–48 hours)
- Audit your own cloud environments for any services listening on industrial protocol ports (502, 102, 2404, 20000). If it's not a legitimate ICS device, shut it down or move it to a non-standard port.
- Update Shodan exposure monitoring to flag your own cloud IP ranges appearing on ICS ports.
Short-term (1–2 weeks)
- Implement port-awareness in firewall rules: Don't assume port 502 = Modbus. Deep packet inspection or protocol-aware IDS should verify that traffic on ICS ports actually uses the expected protocol.
- Tag and segregate cloud test environments that use industrial protocol ports. Ensure they are not internet-routable or indexed by search engines.
Long-term (1–3 months)
- Build an ICS port baseline for your organization. Know which ports are legitimate, where they live, and what speaks on them. Alert on any deviation.
- Push for authenticated industrial protocols where available. Modbus/TCP has no authentication; any service on port 502 is effectively public by default.
Methodology
Scan conducted via the Shodan Developer API using four targeted query blocks, each returning up to 20 results. Anomalies were scored using a multi-factor weirdness engine that evaluates protocol-port mismatches, cloud provider ICS hosting, consumer services on industrial ports, and geographic risk factors. All IP addresses and organization names are defanged per non-attribution policy.
This is one component of the Cyborama OT Intelligence automated perimeter scanning pipeline, running on a bi-weekly schedule.
Subscribe to OT Intelligence
Get automated ICS anomaly alerts, OT threat advisories, and perimeter intelligence delivered to your inbox.
→ View Latest Alerts
Cyborama OT Intelligence · Automated anomaly detection · Scan: 2026-08-13 22:00 UTC
← Back to OT Intelligence