Doing a port scan on the 50000-59999 port range reveals all the connected subscriber modules.
Alfred@localhost:~$ nmap -p 1-65535 10.0.0.2 Starting Nmap 7.60 ( https://nmap.org ) at 2019-09-30 23:55 CDT Nmap scan report for 10.0.0.2 Host is up (0.026s latency). Not shown: 65520 closed ports PORT STATE SERVICE 80/tcp open http 7547/tcp open cwmp 27149/tcp open unknown 59423/tcp open unknown 54984/tcp open unknown 51241/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 19.18 seconds
Should be able to access the login page for the subscriber module by going to https://enodb-ip:xxxxx
Where xxxxx is the port number from the scan. Should be 5 with the last four IMSI numbers of the subscriber unit.