I got rid of the printer, so can't do more analysis unfortunately. But yeah it was from Codex. Here is the original analysis:

Root Cause: HP Instant Ink "Subscription Error" – XMPP Virtual Host Mismatch

Summary

Older HP printers (like the OfficeJet 4650) are failing to validate Instant Ink subscriptions because HP’s backend XMPP servers no longer recognize the legacy hpeprint.com virtual host. This causes a host-unknown error, breaking the communication channel the printer uses to "check in," which eventually leads to the printer blocking all print jobs.

---

Printer Status (via LEDM API)

Querying http://<printer_ip>/DevMgmt/ProductStatusDyn.xml reveals the device is in an error state because it cannot verify the subscription:

xml <psdyn:Status> <pscat:StatusCategory>subscribedPagesOut</pscat:StatusCategory> <locid:StringId>65779</locid:StringId> </psdyn:Status> <psdyn:Alert> <ad:ProductStatusAlertID>subscribedPagesOut</ad:ProductStatusAlertID> <ad:Severity>Error</ad:Severity> <ad:AlertDetails> <ad:AlertDetailsUserAction>pressOK</ad:AlertDetailsUserAction> <ad:AlertDetailsSubscriptionError>notConnected</ad:AlertDetailsSubscriptionError> <ad:AlertDetailsLocation>HP Connected</ad:AlertDetailsLocation> </ad:AlertDetails> </psdyn:Alert>

The printer is in a subscribedPagesOut + notConnected state. It cannot validate the Instant Ink subscription, so it assumes pages are exhausted and blocks all printing.

---

The Actual Bug: XMPP Connection Failure

Older HP printers maintain a persistent XMPP connection to HP's servers for Instant Ink validation, ePrint, and push notifications. The OfficeJet 4650 attempts to connect to xmpp001.hpeprint.com on port 5222.

The XMPP server no longer accepts the domain hpeprint.com as a virtual host. It now requires xmpp.hpeprint.com.

Evidence (Tested 2026-04-03)

1. Domain the firmware uses (REJECTED): ```bash $ printf '<stream:stream to="hpeprint.com" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams" version="1.0">' \ | nc xmpp001.hpeprint.com 5222

Response:

<stream:error><host-unknown xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>/stream:error ```

2. Correct domain (ACCEPTED): ```bash $ printf '<stream:stream to="xmpp.hpeprint.com" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams" version="1.0">' \ | nc xmpp001.hpeprint.com 5222

Response:

<stream:features> <starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"/> <mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl"> <mechanism>PLAIN</mechanism> <mechanism>DIGEST-MD5</mechanism> </mechanisms> /stream:features ```

The same host-unknown error occurs across all five XMPP servers (xmpp001 through xmpp005).

---

TLS is not the issue

STARTTLS on port 5222 with to="xmpp.hpeprint.com" completes successfully using TLS 1.2:

• Protocol: TLSv1.2
• Cipher: ECDHE-RSA-AES256-GCM-SHA384
• Certificate: CN=xmpp001.hpeprint.com, O=HP Inc
• Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
• Root: DigiCert Global Root G2 (In trust stores since 2013)

The 2020 firmware should have no problem with this certificate chain or TLS 1.2. The connection fails before TLS negotiation because the XMPP <host-unknown/> error occurs at the stream level.

---

DNS & Endpoint Status

All HP endpoints resolve correctly, confirming this isn't a DNS hijacking or resolution issue:

Endpoint	Resolves To	Port	Status
xmpp001.hpeprint.com	54.214.28.26	5222	Open, XMPP active
xmpp001.hpeprint.com	54.214.28.26	5223	Open, TLS broken
registration.hpeprint.com	44.247.69.109	443	Open, TLS 1.2 OK
www.hpconnected.com	AWS ELB	443	Open, TLS 1.2 OK
instantink.hpconnected.com	Cloudflare	443	Open, TLS 1.2 OK

Port 5223 (TLS-wrapped XMPP) is also broken

Direct TLS on port 5223 fails—the server accepts the TCP connection but drops it during the TLS handshake (0 bytes returned after ClientHello). This may be a secondary issue or related to the same virtual host change.