External scanning traffic to Siemens S7 PLC port 102 (S7comm)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•6

Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.