314 IPP and 44897 Raw Print Results: The Office Device Layer on the Open Internet

A ZoomEye query conducted on September 22, 2026, revealed 44,897 devices responding on port 9100 for raw print functionality, 314 devices on port 631 for the Internet Printing Protocol (IPP), and 299 devices on port 161 for Simple Network Management Protocol (SNMP). This data indicates that raw print ports are significantly more prevalent than IPP ports, suggesting a higher configuration rate for these devices.

The raw print port, historically associated with HP JetDirect, is accessible without authentication, encryption, or protocol negotiation, making it the simplest method for enabling printing. This default setting explains the high count of devices responding to this port. In contrast, IPP is typically only accessible within local networks or localhost due to its use by the operating system's print subsystem.

IPP over TLS is often bound to a different port and may require authentication, leading to a smaller count compared to raw print. SNMP, used for device management, is less exposed due to its inherent security measures, as confirmed by the small count of responding devices. The data also hints at the potential vulnerabilities associated with these devices, as many are general-purpose computers capable of storing documents, maintaining address books, and storing credentials.

This exposes sensitive information and presents avenues for persistence through unauthenticated firmware updates. The raw print port's ubiquity, coupled with the less secure nature of IPP and SNMP, underscores the importance of securing these devices by disabling unnecessary ports, verifying default administrative passwords, and ensuring firmware updates are current.