Tag archive
Nineteen titles, no fingerprint, and a stable repeat query. What a small count can still prove about a DNS load balancer, and why the recursion test replaces the signature.
A hundred-to-one gap between title and fingerprint matches on a white-labelled helpdesk, and the unauthenticated wizard record that makes the small precise number worth acting on.
A vendor-level fingerprint overcounts exposure and a model-level query returns zero for a product that exists, so neither replaces an internal inventory.
A product rename splits a monitoring plane across two titles with different 443 exposure fractions, and neither name carries a fingerprint.
A renamed product splits across two index fields: 31,843 title matches for XenServer, zero app matches for Citrix Hypervisor, and a union that adds 4,802 more.
A worked example of how fingerprint definitions change exposure counts, using real measurements for F5 and NetScaler.
A product name that case-insensitive title matching cannot separate from a mathematical term.
Why a header query returning 260 assets and an interface scan reporting 2,991 are both correct, and how to use the gap instead of averaging it.
Velociraptor appears in 237 ZoomEye title matches and 15 certificate matches, and the difference between those queries and port-scoped ones explains why endpoint platforms resist external counting.
TDengine returns 3,216 title matches but zero application fingerprints and zero port-scoped matches, a case study in why absence of a signature is not absence of the product.
Four challenger models tried to replace the model my job-search filter runs on. One of them edged it...
A worked example showing why a large reproducible count can still be wrong, and how to validate a search-based exposure figure.