Internet Scanning via Shodan/Censys for Exposed PLC Infrastructure
HYPOTHESIS
If CyberAv3ngers used Shodan and Censys to enumerate internet-exposed water utility PLCs before the July 26-27 Minnesota campaign, the organization's internet-facing OT assets will appear in Shodan/Censys query results for OT-specific ports (44818, 502, 102, 20256), and proxy logs may show Shodan API queries from within the organization that reveal whether adversaries accessed a shared IP inventory.
DATA SOURCES
Shodan/Censys API (self-query for organizational IP exposure)Perimeter firewall logs (inbound to OT ports from scanner IPs)Web proxy logs (outbound to shodan.io/censys.io APIs)OT asset inventory (compare to Shodan exposure results)
Priority: MEDIUM
NOTES
For MENA water and energy utilities: Gulf state critical infrastructure is actively indexed on Shodan. Running 'port:44818 country:AE' or 'port:44818 country:SA' on Shodan reveals dozens of exposed PLCs. This is a critical pre-exploitation assessment all OT operators should perform for their own infrastructure.