The nonprofit cybersecurity organization is scanning the web for exposed services that use the Modbus industrial communications protocol on TCP port 502, but Shadowserver’s Piotr Kijewski told SecurityWeek that they plan on introducing many other ICS and operational technology (OT) protocol scans in the near future.

Shadowserver has been working with national cybersecurity agencies, law enforcement, private companies and security researchers worldwide to provide free information that defenders can use to mitigate vulnerabilities, detect malicious activities, and counter threats. The organization describes itself as the “world’s largest provider of free, public benefit cyber threat intelligence data feeds.”