3CX at 976,119 titles and 31,398 fingerprints: one product name, two very different populations

A title search for 3CX returns 976,119 matches in ZoomEye. The application fingerprint app="3CX" returns 31,398. Both numbers describe the same product name, and the gap between them is thirty-one to one.

That gap is the subject of this article. It is not a defect in either query. It is what happens when a product is well known enough that other people write its name on their own pages, and it changes what an asset owner can conclude from a search result.

What the two queries actually measure

title="3CX" performs a word-segmented match against the HTML title of a web page. Any page whose title contains the token 3CX qualifies: a reseller's product page, a support article, a comparison post, the login screen of a hosted instance, and the management console of a self-hosted PBX.

app="3CX" asks ZoomEye to return assets that its fingerprinting engine has identified as 3CX. That is a narrower claim, because it depends on the engine recognising a product-specific pattern in the response rather than reading a word in a heading.

The result is not that one query is right and the other is wrong. The title query measures how widely the product name appears in indexed web content. The fingerprint query measures how many assets the engine can positively attribute. Both are useful, and they answer different questions.

Why a 31x gap should change the next query

If an owner of 3CX deployments queries the title field and treats the result as an inventory, the number is unusable for scoping. A security team cannot triage 976,119 assets, and most of them are not PBXs.

The gap is also a reminder about the direction of error. A title match can produce false positives, because a page can mention a product without running it. A fingerprint can produce false negatives, because the engine may not recognise a deployment whose login page has been customised, whose console sits behind a proxy, or whose version predates the pattern the engine knows.

Neither error direction is safe to ignore. Over-counting produces paralysis. Under-counting produces silence, and silence looks like a clean result.

Reading the number as a range

The honest conclusion from these two queries is that the internet-visible 3CX population is somewhere between 31,398 and 976,119, and that the lower bound is the one supported by positive identification. Anyone who reports a single figure should say which query produced it.

There is a practical way to narrow the range for a specific estate. Combine the product name with a field that only a running instance would carry. A management console has a login form and a service on its listening port; a marketing page does not. Narrowing by port or by a response-header value that the product sets will move the count toward the fingerprint figure, and the size of the remaining set tells you how much of the title population is genuinely product-adjacent.

What this means for a 3CX owner

The query result is not the inventory. The inventory is the list of instances the organisation actually owns, and the internet measurement is a check on whether that list is complete.

The useful comparison runs in one direction: take your own list, query each host by IP or CIDR in ZoomEye, and see whether the engine agrees that it is a 3CX asset. A host you know is running the product but the engine cannot identify is a fingerprint gap; a host the engine identifies that is not on your list is an unknown deployment, and that one deserves a ticket.

Running the comparison in the other direction, from the global count down to your estate, does not work. The global count has no ownership information in it.

Collection and scope

All counts in this article were collected on 2026-10-28 (Beijing time) through the ZoomEye AI SDK, page size 1, sub-type all. The totals are matched-asset counts returned by the API, not the number of records retrieved.

Query	Matches
title="3CX"	976,119
app="3CX"	31,398

A count of matches is not a count of vulnerable systems. Nothing in these queries tests a version, a configuration or a vulnerability, and the presence of a product fingerprint says only that the engine recognised the product.

References

[1] ZoomEye AI search, queries title="3CX" and app="3CX", collected 2026-10-28. https://www.zoomeye.ai/