recog-intrigue 2.3.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/smtp_banners.xml ADDED
@@ -0,0 +1,1690 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
3
+ <!--
4
+ SMTP greeting lines (part of the banner after the response code) are matched
5
+ against these patterns (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ This is always done in addition to the patterns in other smtp_*.xml files.
8
+ These XML files are used in this order:
9
+ smtp_banners.xml
10
+ smtp_ehlo.xml
11
+ smtp_help.xml
12
+ smtp_noop.xml
13
+ smtp_expn.xml
14
+ smtp_vrfy.xml
15
+ smtp_debug.xml
16
+ smtp_turn.xml
17
+ smtp_rset.xml
18
+ smtp_quit.xml
19
+
20
+ The system or service fingerprint with the highest certainty overwrites the others.
21
+
22
+ 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
23
+ Additionally, the 'preference' value for the other databases mentioned above has been set so
24
+ as to implement their preference as described.
25
+ -->
26
+ <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
27
+ <description>IMail - EVAL version</description>
28
+ <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 EVAL 11347-1)</example>
29
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
30
+ <param pos="0" name="service.family" value="IMail Server"/>
31
+ <param pos="0" name="service.product" value="IMail Server"/>
32
+ <param pos="2" name="service.version"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
34
+ <param pos="1" name="host.name"/>
35
+ <param pos="0" name="imail.eval" value="yes"/>
36
+ </fingerprint>
37
+ <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\)$">
38
+ <description>IMail - non-EVAL version</description>
39
+ <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 899085-1)</example>
40
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
41
+ <param pos="0" name="service.family" value="IMail Server"/>
42
+ <param pos="0" name="service.product" value="IMail Server"/>
43
+ <param pos="2" name="service.version"/>
44
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
45
+ <param pos="1" name="host.name"/>
46
+ </fingerprint>
47
+ <fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
48
+ <description>IMail - non-EVAL version, NT-ESMTP at end</description>
49
+ <example service.version="12.4.2.27">foo.bar (IMail 12.4.2.27 21349-1) NT-ESMTP Server X1</example>
50
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
51
+ <param pos="0" name="service.family" value="IMail Server"/>
52
+ <param pos="0" name="service.product" value="IMail Server"/>
53
+ <param pos="2" name="service.version"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
55
+ <param pos="1" name="host.name"/>
56
+ </fingerprint>
57
+ <fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
58
+ <description>AnalogX proxy (http://www.analogx.com/contents/download/network/proxy.htm)</description>
59
+ <example host.name="192.168.1.1" service.version="4.15">192.168.1.1 SMTP AnalogX Proxy 4.15 (Release) ready</example>
60
+ <param pos="0" name="service.vendor" value="AnalogX"/>
61
+ <param pos="0" name="service.family" value="Proxy"/>
62
+ <param pos="0" name="service.product" value="Proxy"/>
63
+ <param pos="2" name="service.version"/>
64
+ <param pos="0" name="service.cpe23" value="cpe:/a:analogx:proxy:{service.version}"/>
65
+ <param pos="1" name="host.name"/>
66
+ </fingerprint>
67
+ <fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
68
+ <description>ArGoSoft Mail Server</description>
69
+ <example service.version="1.4.0.7">ArGoSoft Mail Server, Version 1.4 (1.4.0.7)</example>
70
+ <param pos="0" name="os.vendor" value="Microsoft"/>
71
+ <param pos="0" name="os.family" value="Windows"/>
72
+ <param pos="0" name="os.product" value="Windows"/>
73
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
74
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
75
+ <param pos="0" name="service.family" value="Mail Server"/>
76
+ <param pos="0" name="service.product" value="Mail Server"/>
77
+ <param pos="1" name="service.version"/>
78
+ </fingerprint>
79
+ <fingerprint pattern="^^(?:(\S+) +)?ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
80
+ <description>ArGoSoft Mail Server - freeware version</description>
81
+ <example host.name="foo.bar" service.version="1.8.8.8">foo.bar ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
82
+ <example service.version="1.8.8.8">ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
83
+ <param pos="0" name="os.vendor" value="Microsoft"/>
84
+ <param pos="0" name="os.family" value="Windows"/>
85
+ <param pos="0" name="os.product" value="Windows"/>
86
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
87
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
88
+ <param pos="0" name="service.family" value="Mail Server"/>
89
+ <param pos="0" name="service.product" value="Mail Server"/>
90
+ <param pos="2" name="service.version"/>
91
+ <param pos="1" name="host.name"/>
92
+ </fingerprint>
93
+ <fingerprint pattern="^(?:(\S+) +)?ArGoSoft Mail Server Pro for WinNT\/2000(?:\/XP)?, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
94
+ <description>ArGoSoft Mail Server - Pro version</description>
95
+ <example service.version="1.6.1.8">ArGoSoft Mail Server Pro for WinNT/2000, Version 1.61 (1.6.1.8)</example>
96
+ <example service.version="1.8.9.5">ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
97
+ <example host.name="foo.bar" service.version="1.8.9.5">foo.bar ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
98
+ <param pos="0" name="os.vendor" value="Microsoft"/>
99
+ <param pos="0" name="os.family" value="Windows"/>
100
+ <param pos="0" name="os.product" value="Windows"/>
101
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
102
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
103
+ <param pos="0" name="service.family" value="Mail Server"/>
104
+ <param pos="0" name="service.product" value="Mail Server"/>
105
+ <param pos="1" name="host.name"/>
106
+ <param pos="2" name="service.version"/>
107
+ </fingerprint>
108
+ <fingerprint pattern="^([^ ]+) +AppleShare IP Mail Server ([^ ]+\.[\d.]+) SMTP Server Ready *$">
109
+ <description>AppleShare IP Mail Server</description>
110
+ <example service.version="6.2.1">foo.bar AppleShare IP Mail Server 6.2.1 SMTP Server Ready</example>
111
+ <example service.version="6.2">foo.bar AppleShare IP Mail Server 6.2 SMTP Server Ready</example>
112
+ <param pos="0" name="service.vendor" value="Apple"/>
113
+ <param pos="0" name="service.family" value="AppleShare IP Mail Server"/>
114
+ <param pos="0" name="service.product" value="AppleShare IP Mail Server"/>
115
+ <param pos="1" name="host.name"/>
116
+ <param pos="2" name="service.version"/>
117
+ </fingerprint>
118
+ <fingerprint pattern="^CheckPoint FireWall-1 secure E?SMTP server *$">
119
+ <description>CheckPoint FireWall-1</description>
120
+ <example>CheckPoint FireWall-1 secure SMTP server</example>
121
+ <example>CheckPoint FireWall-1 secure ESMTP server</example>
122
+ <param pos="0" name="service.vendor" value="Check Point"/>
123
+ <param pos="0" name="service.family" value="Check Point"/>
124
+ <param pos="0" name="service.product" value="Firewall-1"/>
125
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
126
+ </fingerprint>
127
+ <fingerprint pattern="^SMTP/cmap ready_+$">
128
+ <description>Cisco Pix v4.x</description>
129
+ <example>SMTP/cmap ready________________________________________________________________________</example>
130
+ <param pos="0" name="os.vendor" value="Cisco"/>
131
+ <param pos="0" name="os.family" value="PIX"/>
132
+ <param pos="0" name="os.product" value="PIX"/>
133
+ <param pos="0" name="os.version" value="4"/>
134
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:4"/>
135
+ </fingerprint>
136
+ <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
137
+ <description>Youngzsoft CCProxy SMTP</description>
138
+ <example service.version="7.3">CCProxy 7.3 SMTP Service Ready(Unregistered)</example>
139
+ <param pos="0" name="service.vendor" value="Youngzsoft"/>
140
+ <param pos="0" name="service.family" value="CCProxy"/>
141
+ <param pos="0" name="service.product" value="CCProxy"/>
142
+ <param pos="1" name="service.version"/>
143
+ </fingerprint>
144
+ <!--
145
+ Cisco PIX sits between an internal SMTP server and the rest of the world.
146
+
147
+ Its MailGuard feature strips all information out of the 220 header except for the ' ' (space), '2' (digit two),
148
+ and '0' (digit zero) characters, replacing them with asterisks. While this effectively
149
+ hides the back-end SMTP server, it does tell us that they are running Cisco PIX firewall
150
+ (at least for SMTP, and possibly other services as well).
151
+
152
+ Search Cisco's documentation for "fixup protocol SMTP" for more information.
153
+ -->
154
+ <fingerprint pattern="^[\*20 ]+$">
155
+ <description>Cisco PIX firewall MailGuard banner stripping</description>
156
+ <example os.product="PIX">***************************</example>
157
+ <param pos="0" name="os.vendor" value="Cisco"/>
158
+ <param pos="0" name="os.family" value="PIX"/>
159
+ <param pos="0" name="os.product" value="PIX"/>
160
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
161
+ </fingerprint>
162
+ <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
163
+ <description>Critical Path (aka InScribe) Messaging Server on Windows NT4/2k, Solaris 2.6/2.7/2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, or AIX </description>
164
+ <param pos="0" name="service.vendor" value="Critical Path"/>
165
+ <param pos="0" name="service.family" value="Messaging Server"/>
166
+ <param pos="0" name="service.product" value="Messaging Server"/>
167
+ <param pos="1" name="host.name"/>
168
+ <param pos="2" name="service.version"/>
169
+ <param pos="3" name="service.version.version"/>
170
+ <param pos="4" name="service.version.version.version"/>
171
+ <param pos="5" name="service.version.version.version.version"/>
172
+ </fingerprint>
173
+ <fingerprint pattern="^CSM Internet Mail Scanner SMTP-Gateway ready?\. *$">
174
+ <description>CSM Internet Mail Scanner SMTP Proxy</description>
175
+ <example>CSM Internet Mail Scanner SMTP-Gateway ready.</example>
176
+ <example>CSM Internet Mail Scanner SMTP-Gateway read.</example>
177
+ <param pos="0" name="service.vendor" value="CSM"/>
178
+ <param pos="0" name="service.family" value="Internet Mail Scanner"/>
179
+ <param pos="0" name="service.product" value="Internet Mail Scanner"/>
180
+ </fingerprint>
181
+ <fingerprint pattern="^([^ ]+) +IMS SMTP Receiver Version ([^ ]+\.[^ ]+) Ready *$">
182
+ <description>EMWAC Internet Mail Services (http://emwac.ed.ac.uk/html/internet_toolchest/ims/ims.htm)</description>
183
+ <example service.version="0.83" host.name="foo.bar">foo.bar IMS SMTP Receiver Version 0.83 Ready</example>
184
+ <param pos="0" name="service.vendor" value="EMWAC"/>
185
+ <param pos="0" name="service.family" value="Internet Mail Services"/>
186
+ <param pos="0" name="service.product" value="Internet Mail Services"/>
187
+ <param pos="1" name="host.name"/>
188
+ <param pos="2" name="service.version"/>
189
+ </fingerprint>
190
+ <fingerprint pattern="^([^ ]+) running Eudora Internet Mail Server (\d\.[\d.]+) *$">
191
+ <description>Eudora Internet Mail Server</description>
192
+ <example service.version="3.0.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 3.0.2</example>
193
+ <example service.version="2.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 2.2</example>
194
+ <param pos="0" name="service.vendor" value="Eudora"/>
195
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
196
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
197
+ <param pos="0" name="os.vendor" value="Apple"/>
198
+ <param pos="0" name="os.family" value="Mac OS"/>
199
+ <param pos="0" name="os.product" value="Mac OS"/>
200
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
201
+ <param pos="1" name="host.name"/>
202
+ <param pos="2" name="service.version"/>
203
+ </fingerprint>
204
+ <fingerprint pattern="^([^ ]+) +ESMTP Server \(Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+)\) ready *$">
205
+ <description>Microsoft Exchange Server 5.5 and above (for sure, can't be confused with the IIS builtin SMTP service)</description>
206
+ <example host.name="foo.bar" service.version="5.5.2653.13">foo.bar ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready</example>
207
+ <param pos="0" name="service.vendor" value="Microsoft"/>
208
+ <param pos="0" name="service.family" value="Exchange Server"/>
209
+ <param pos="0" name="service.product" value="Exchange Server"/>
210
+ <param pos="2" name="service.version"/>
211
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
212
+ <param pos="1" name="host.name"/>
213
+ <param pos="0" name="os.vendor" value="Microsoft"/>
214
+ <param pos="0" name="os.family" value="Windows"/>
215
+ <param pos="0" name="os.product" value="Windows"/>
216
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
217
+ </fingerprint>
218
+ <fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
219
+ <description>Microsoft Exchange Server 5.0 (for sure, can't be confused with the IIS builtin SMTP service)</description>
220
+ <example host.name="foo.bar" service.version="5.0.1460.8">foo.bar Microsoft Exchange Internet Mail Service 5.0.1460.8 ready</example>
221
+ <param pos="0" name="service.vendor" value="Microsoft"/>
222
+ <param pos="0" name="service.family" value="Exchange Server"/>
223
+ <param pos="0" name="service.product" value="Exchange Server"/>
224
+ <param pos="2" name="service.version"/>
225
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
226
+ <param pos="1" name="host.name"/>
227
+ <param pos="0" name="os.vendor" value="Microsoft"/>
228
+ <param pos="0" name="os.family" value="Windows"/>
229
+ <param pos="0" name="os.product" value="Windows"/>
230
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
231
+ </fingerprint>
232
+ <fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
233
+ <description>Microsoft Exchange 2007/2010 (for sure, can't be confused with the IIS builtin SMTP service)</description>
234
+ <example>foo.bar Microsoft ESMTP MAIL Service ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
235
+ <param pos="0" name="service.vendor" value="Microsoft"/>
236
+ <param pos="0" name="service.family" value="Exchange Server"/>
237
+ <param pos="0" name="service.product" value="Exchange Server"/>
238
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
239
+ <param pos="1" name="host.name"/>
240
+ <param pos="0" name="os.vendor" value="Microsoft"/>
241
+ <param pos="0" name="os.family" value="Windows"/>
242
+ <param pos="0" name="os.product" value="Windows"/>
243
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
244
+ </fingerprint>
245
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(10\.0\.14393\.[\d.]+) +ready +(?:at +)?(.+)$">
246
+ <description>Microsoft IIS builtin SMTP service - Windows Server 2016</description>
247
+ <example host.name="foo.bar" service.version="10.0.14393.2608">foo.bar Microsoft ESMTP MAIL Service, Version: 10.0.14393.2608 ready at Sun, 19 May 2019 09:04:29 -0500</example>
248
+ <param pos="0" name="service.vendor" value="Microsoft"/>
249
+ <param pos="0" name="service.family" value="IIS"/>
250
+ <param pos="0" name="service.product" value="IIS"/>
251
+ <param pos="2" name="service.version"/>
252
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:10.0"/>
253
+ <param pos="1" name="host.name"/>
254
+ <param pos="3" name="system.time"/>
255
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
256
+ <param pos="0" name="os.vendor" value="Microsoft"/>
257
+ <param pos="0" name="os.family" value="Windows"/>
258
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
259
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
260
+ </fingerprint>
261
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(10\.0\.17763\.[\d.]+) +ready +(?:at +)?(.+)$">
262
+ <description>Microsoft IIS builtin SMTP service - Windows Server 2019</description>
263
+ <example host.name="foo.bar" service.version="10.0.17763.1">foo.bar Microsoft ESMTP MAIL Service, Version: 10.0.17763.1 ready at Sun, 19 May 2019 09:04:29 -0500</example>
264
+ <param pos="0" name="service.vendor" value="Microsoft"/>
265
+ <param pos="0" name="service.family" value="IIS"/>
266
+ <param pos="0" name="service.product" value="IIS"/>
267
+ <param pos="2" name="service.version"/>
268
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:10.0"/>
269
+ <param pos="1" name="host.name"/>
270
+ <param pos="3" name="system.time"/>
271
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
272
+ <param pos="0" name="os.vendor" value="Microsoft"/>
273
+ <param pos="0" name="os.family" value="Windows"/>
274
+ <param pos="0" name="os.product" value="Windows Server 2019"/>
275
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2019:-"/>
276
+ </fingerprint>
277
+ <fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
278
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 1</description>
279
+ <example host.name="foo.bar" service.version="5.5.1877.197.19">foo.bar Microsoft SMTP MAIL ready at Wed, 29 Nov 2017 23:48:59 +0000 Version: 5.5.1877.197.19</example>
280
+ <param pos="0" name="service.vendor" value="Microsoft"/>
281
+ <param pos="0" name="service.family" value="IIS"/>
282
+ <param pos="0" name="service.product" value="IIS"/>
283
+ <param pos="3" name="service.version"/>
284
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
285
+ <param pos="1" name="host.name"/>
286
+ <param pos="2" name="system.time"/>
287
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
288
+ <param pos="0" name="os.vendor" value="Microsoft"/>
289
+ <param pos="0" name="os.family" value="Windows"/>
290
+ <param pos="0" name="os.product" value="Windows"/>
291
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
292
+ </fingerprint>
293
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+)(?: +ready)?(?: +(?:at +)?(\w\w\w, \d.+))?$">
294
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 2 </description>
295
+ <example service.version="5.0.2195.5329"> Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready Thu, 30 Nov 2017 11:40:25 +0200</example>
296
+ <example service.version="6.0.3790.4675" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
297
+ <example service.version="6.0.2600.5512" system.time="Thu, 30 Nov 2017 18:22:40 +0900">Microsoft ESMTP MAIL Service, Version: 6.0.2600.5512 ready at Thu, 30 Nov 2017 18:22:40 +0900</example>
298
+ <example service.version="6.0.3790.3959" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready</example>
299
+ <example service.version="6.0.3790.1830" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830</example>
300
+ <param pos="0" name="service.vendor" value="Microsoft"/>
301
+ <param pos="0" name="service.family" value="IIS"/>
302
+ <param pos="0" name="service.product" value="IIS"/>
303
+ <param pos="2" name="service.version"/>
304
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
305
+ <param pos="1" name="host.name"/>
306
+ <param pos="3" name="system.time"/>
307
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
308
+ <param pos="0" name="os.vendor" value="Microsoft"/>
309
+ <param pos="0" name="os.family" value="Windows"/>
310
+ <param pos="0" name="os.product" value="Windows"/>
311
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
312
+ </fingerprint>
313
+ <fingerprint pattern="^ESMTP Exim$">
314
+ <description>Exim - without version string or hostname</description>
315
+ <example>ESMTP Exim</example>
316
+ <param pos="0" name="service.vendor" value="exim"/>
317
+ <param pos="0" name="service.family" value="exim"/>
318
+ <param pos="0" name="service.product" value="exim"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
320
+ </fingerprint>
321
+ <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
322
+ <description>Exim - with version string and optional timestamp</description>
323
+ <example service.version="4.89" host.name="foo.bar">foo.bar ESMTP Exim 4.89 "</example>
324
+ <example service.version="4.83" host.name="foo.bar">foo.bar, ESMTP EXIM 4.83</example>
325
+ <example service.version="4.84_2" host.name="foo.bar">foo.bar ESMTP Exim 4.84_2 </example>
326
+ <example service.version="4.90_RC3" host.name="foo.bar">foo.bar ESMTP Exim 4.90_RC3 Thu, 30 Nov 2017 03:52:16 -0700 </example>
327
+ <example service.version="4.89_1b" host.name="foo.bar">foo.bar ESMTP Exim 4.89_1b Thu, 05 Apr 2018 21:30:37 +0200</example>
328
+ <example service.version="4.89-122312">foo.bar ESMTP Exim 4.89-122312 Thu, 16 Nov 2017 10:33:38 +0200 </example>
329
+ <example service.version="4.87">foo.bar ESMTP (Exim 4.87) Thu, 30 Nov 2017 03:25:58 -0800 </example>
330
+ <example service.version="4.80" system.time="Thu, 16 Nov 2017 01:04:30 -0800">foo.bar ESMTP Exim 4.80 Thu, 16 Nov 2017 01:04:30 -0800 </example>
331
+ <example service.version="3.12" system.time="Wed, 31 Jan 2001 15:47:23 +1100">foo.bar ESMTP Exim 3.12 #1 Wed, 31 Jan 2001 15:47:23 +1100 </example>
332
+ <example service.version="4.89" host.name="foo.bar"> foo.bar ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 04:55:31 -0500 We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.</example>
333
+ <param pos="0" name="service.vendor" value="exim"/>
334
+ <param pos="0" name="service.family" value="exim"/>
335
+ <param pos="0" name="service.product" value="exim"/>
336
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
337
+ <param pos="1" name="host.name"/>
338
+ <param pos="2" name="service.version"/>
339
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
340
+ <param pos="3" name="system.time"/>
341
+ </fingerprint>
342
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
343
+ <description>Exim - with digit only version string and optional timestamp</description>
344
+ <example service.version="125302" host.name="foo.bar">foo.bar ESMTP Exim 125302 Thu, 16 Nov 2017 04:55:11 -0500 </example>
345
+ <param pos="0" name="service.vendor" value="exim"/>
346
+ <param pos="0" name="service.family" value="exim"/>
347
+ <param pos="0" name="service.product" value="exim"/>
348
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
349
+ <param pos="1" name="host.name"/>
350
+ <param pos="2" name="service.version"/>
351
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
352
+ <param pos="3" name="system.time"/>
353
+ </fingerprint>
354
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
355
+ <description>Exim - with version string and optional timestamp (Ubuntu)</description>
356
+ <example service.version="4.82" system.time="Thu, 16 Nov 2017 11:30:44 +0300">foo.bar ESMTP Exim 4.82 Ubuntu Thu, 16 Nov 2017 11:30:44 +0300 </example>
357
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
358
+ <param pos="0" name="os.family" value="Linux"/>
359
+ <param pos="0" name="os.product" value="Linux"/>
360
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
361
+ <param pos="0" name="service.vendor" value="exim"/>
362
+ <param pos="0" name="service.family" value="exim"/>
363
+ <param pos="0" name="service.product" value="exim"/>
364
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
365
+ <param pos="1" name="host.name"/>
366
+ <param pos="2" name="service.version"/>
367
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
368
+ <param pos="3" name="system.time"/>
369
+ </fingerprint>
370
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
371
+ <description>Exim - without version string and with optional timestamp</description>
372
+ <example host.name="foo.bar">foo.bar ESMTP Exim</example>
373
+ <example host.name="foo.bar" system.time="Thu, 16 Nov 2017 01:11:30 -0800">foo.bar ESMTP Exim Thu, 16 Nov 2017 01:11:30 -0800 </example>
374
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:31:32 -0500">foo.bar ESMTP Exim #1 Thu, 30 Nov 2017 05:31:32 -0500 </example>
375
+ <param pos="0" name="service.vendor" value="exim"/>
376
+ <param pos="0" name="service.family" value="exim"/>
377
+ <param pos="0" name="service.product" value="exim"/>
378
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
379
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
380
+ <param pos="1" name="host.name"/>
381
+ <param pos="2" name="system.time"/>
382
+ </fingerprint>
383
+ <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
384
+ <description>Exim - without hostname</description>
385
+ <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
386
+ <example service.version="4.82"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
387
+ <example service.version="4.89"> ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 07:32:28 -0200 </example>
388
+ <param pos="0" name="service.vendor" value="exim"/>
389
+ <param pos="0" name="service.family" value="exim"/>
390
+ <param pos="0" name="service.product" value="exim"/>
391
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
392
+ <param pos="1" name="service.version"/>
393
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
394
+ <param pos="2" name="system.time"/>
395
+ </fingerprint>
396
+ <fingerprint pattern="^ ?([^, ]+) Exim ESMTP Service ready$">
397
+ <description>Exim - with hostname </description>
398
+ <example host.name="foo.bar">foo.bar Exim ESMTP Service ready</example>
399
+ <param pos="0" name="service.vendor" value="exim"/>
400
+ <param pos="0" name="service.family" value="exim"/>
401
+ <param pos="0" name="service.product" value="exim"/>
402
+ <param pos="1" name="host.name"/>
403
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
404
+ </fingerprint>
405
+ <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
406
+ <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
407
+ <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
408
+ <param pos="0" name="service.vendor" value="Floosietek"/>
409
+ <param pos="0" name="service.family" value="FTGate"/>
410
+ <param pos="0" name="service.product" value="FTGate"/>
411
+ <param pos="1" name="host.name"/>
412
+ </fingerprint>
413
+ <fingerprint pattern="^([^ ]+) +SMTP/smap Ready\.$">
414
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
415
+ <example host.name="foo.bar">foo.bar SMTP/smap Ready.</example>
416
+ <param pos="0" name="service.vendor" value="TIS"/>
417
+ <param pos="0" name="service.family" value="FWTK"/>
418
+ <param pos="0" name="service.product" value="FWTK"/>
419
+ <param pos="1" name="host.name"/>
420
+ </fingerprint>
421
+ <fingerprint pattern="^([^ ]+) GroupWise Internet Agent ([^ ]+\.[^ ]+\.[^ ]+) Ready \(C\).* Novell, Inc\. *$">
422
+ <description>Novell GroupWise Internet Agent - versions 5 and higher</description>
423
+ <example service.version="5.5.1">foo.bar GroupWise Internet Agent 5.5.1 Ready (C)1993, 1998 Novell, Inc.</example>
424
+ <param pos="0" name="service.vendor" value="Novell"/>
425
+ <param pos="0" name="service.family" value="GroupWise"/>
426
+ <param pos="0" name="service.product" value="GroupWise"/>
427
+ <param pos="1" name="host.name"/>
428
+ <param pos="2" name="service.version"/>
429
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
430
+ </fingerprint>
431
+ <fingerprint pattern="^([^ ]+) GroupWise Internet Agent (\d+\.[\d.]+) Copyright .*\d{4}-\d{4} Novell, Inc..* All rights reserved. Ready *$">
432
+ <description>Novell GroupWise Internet Agent - versions 5 and higher, second variant</description>
433
+ <example service.version="8.0.3">foo.bar GroupWise Internet Agent 8.0.3 Copyright (c) 1993-2012 Novell, Inc. All rights reserved. Ready</example>
434
+ <example service.version="14.2.1">foo.bar GroupWise Internet Agent 14.2.1 Copyright 1993-2016 Novell, Inc., a Micro Focus Company. All rights reserved. Ready</example>
435
+ <param pos="0" name="service.vendor" value="Novell"/>
436
+ <param pos="0" name="service.family" value="GroupWise"/>
437
+ <param pos="0" name="service.product" value="GroupWise"/>
438
+ <param pos="1" name="host.name"/>
439
+ <param pos="2" name="service.version"/>
440
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
441
+ </fingerprint>
442
+ <fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
443
+ <description>Novell GroupWise - versions below 5</description>
444
+ <example host.name="foo.bar" service.version="4.1" service.version.version="3">foo.bar GroupWise SMTP/MIME Daemon 4.1 v3 Ready (C)1993, 1996 Novell, Inc.</example>
445
+ <param pos="0" name="service.vendor" value="Novell"/>
446
+ <param pos="0" name="service.family" value="GroupWise"/>
447
+ <param pos="0" name="service.product" value="GroupWise"/>
448
+ <param pos="1" name="host.name"/>
449
+ <param pos="2" name="service.version"/>
450
+ <param pos="3" name="service.version.version"/>
451
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
452
+ </fingerprint>
453
+ <fingerprint pattern="^([^ ]+) (?:ESMTP )?running IBM VM SMTP (.+)(?:; | on )(.+) *$">
454
+ <description>IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.</description>
455
+ <example service.version="Level 640" system.time="Thu, 30 Nov 2017 01:08:59 PDT">foo.bar running IBM VM SMTP Level 640 on Thu, 30 Nov 2017 01:08:59 PDT</example>
456
+ <example service.version="Level 3A0">foo.bar running IBM VM SMTP Level 3A0 on Mon, 10 Sep 2001 07:21:54 EDT</example>
457
+ <example service.version="V2R4" system.time="Mon, 10 Sep 2001 07:24:35 -0400 (EDT)">foo.bar ESMTP running IBM VM SMTP V2R4; Mon, 10 Sep 2001 07:24:35 -0400 (EDT)</example>
458
+ <param pos="0" name="service.vendor" value="IBM"/>
459
+ <param pos="0" name="service.family" value="VM"/>
460
+ <param pos="0" name="service.product" value="VM"/>
461
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
462
+ <param pos="1" name="host.name"/>
463
+ <param pos="2" name="service.version"/>
464
+ <param pos="3" name="system.time"/>
465
+ </fingerprint>
466
+ <fingerprint pattern="^([^ ]+) \(IntraStore TurboSendmail\) ESMTP Service ready *$">
467
+ <description>
468
+ Syntegra/CDC IntraStore TurboSendmail, part of the IntraStore server which runs on
469
+ the following platforms ONLY: Linux, HP-UX, Solaris, AIX, and Windows NT/2000
470
+ see http://www.cdc.com for more information
471
+ </description>
472
+ <example host.name="192.168.1.1">192.168.1.1 (IntraStore TurboSendmail) ESMTP Service ready</example>
473
+ <param pos="0" name="service.vendor" value="BT"/>
474
+ <param pos="0" name="service.family" value="IntraStore"/>
475
+ <param pos="0" name="service.product" value="IntraStore"/>
476
+ <param pos="1" name="host.name"/>
477
+ </fingerprint>
478
+ <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) \(.+\)$">
479
+ <description>JAMES SMTP Server</description>
480
+ <example host.name="foo.bar" service.version="2.3.2">foo.bar SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
481
+ <param pos="0" name="service.vendor" value="Apache"/>
482
+ <param pos="0" name="service.product" value="James"/>
483
+ <param pos="2" name="service.version"/>
484
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:james:{service.version}"/>
485
+ <param pos="1" name="host.name"/>
486
+ <param pos="3" name="system.time"/>
487
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
488
+ </fingerprint>
489
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: ([\d.]+)$">
490
+ <description>MailEnable - Simple</description>
491
+ <example service.version="9.53">ESMTP MailEnable Service, Version: 9.53</example>
492
+ <param pos="0" name="os.vendor" value="Microsoft"/>
493
+ <param pos="0" name="os.family" value="Windows"/>
494
+ <param pos="0" name="os.product" value="Windows"/>
495
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
496
+ <param pos="0" name="service.vendor" value="MailEnable"/>
497
+ <param pos="0" name="service.family" value="Mail Server"/>
498
+ <param pos="0" name="service.product" value="Mail Server"/>
499
+ <param pos="1" name="host.name"/>
500
+ <param pos="2" name="service.version"/>
501
+ <param pos="0" name="service.cpe23" value="cpe:/a:mailenable:mailenable:{service.version}"/>
502
+ </fingerprint>
503
+ <!-- MailEnable has an odd, three version string. Not sure about the meaning the second and third version #s. -->
504
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: (?:([\d.]+))?-[\d.]*-[\d.]* (?:ready|denied access) at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
505
+ <description>MailEnable - Complex</description>
506
+ <example host.name="foo.bar" service.version="1.8">foo.bar ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
507
+ <example host.name="foo.bar" service.version="9.53">foo.bar ESMTP MailEnable Service, Version: 9.53-9.53- ready at 11/30/17 00:57:37</example>
508
+ <example host.name="foo.bar" service.version="9.00" system.time="11/30/17 09:30:34">foo.bar ESMTP MailEnable Service, Version: 9.00--9.00 ready at 11/30/17 09:30:34</example>
509
+ <example host.name="foo.bar" service.version="1.986" system.time="04/05/18 16:15:25">foo.bar ESMTP MailEnable Service, Version: 1.986-- denied access at 04/05/18 16:15:25</example>
510
+ <param pos="0" name="os.vendor" value="Microsoft"/>
511
+ <param pos="0" name="os.family" value="Windows"/>
512
+ <param pos="0" name="os.product" value="Windows"/>
513
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
514
+ <param pos="0" name="service.vendor" value="MailEnable"/>
515
+ <param pos="0" name="service.family" value="Mail Server"/>
516
+ <param pos="0" name="service.product" value="Mail Server"/>
517
+ <param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
518
+ <param pos="1" name="host.name"/>
519
+ <param pos="2" name="service.version"/>
520
+ <param pos="0" name="service.cpe23" value="cpe:/a:mailenable:mailenable:{service.version}"/>
521
+ <param pos="3" name="system.time"/>
522
+ </fingerprint>
523
+ <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.[\d\.]+), (.+, .+)\) ESMTP Mail Server Ready. *$">
524
+ <description>Mail Max</description>
525
+ <example host.name="foo.bar" service.version="4.2.4.7">foo.bar (Mail-Max Version 4.2.4.7, Wed, 31 Jan 2001 03:44:35 +0100 WST) ESMTP Mail Server Ready.</example>
526
+ <example host.name="foo.bar" service.version="3.073">foo.bar (Mail-Max Version 3.073, Thu, 30 Nov 2017 17:24:59 +0800 ) ESMTP Mail Server Ready.</example>
527
+ <param pos="0" name="service.vendor" value="Mail-Max"/>
528
+ <param pos="0" name="service.family" value="Mail-Max"/>
529
+ <param pos="0" name="service.product" value="Mail-Max"/>
530
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
531
+ <param pos="1" name="host.name"/>
532
+ <param pos="2" name="service.version"/>
533
+ <param pos="3" name="system.time"/>
534
+ </fingerprint>
535
+ <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
536
+ <description>Rockliffe MailSite - with version (http://www.rockliffe.com)</description>
537
+ <example host.name="foo.bar" service.version="3.4.6.0">foo.bar MailSite ESMTP Receiver Version 3.4.6.0 Ready</example>
538
+ <example host.name="foo.bar" service.version="2.1.7">foo.bar MailSite SMTP Receiver Version 2.1.7 Ready</example>
539
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
540
+ <param pos="0" name="service.family" value="MailSite"/>
541
+ <param pos="0" name="service.product" value="MailSite"/>
542
+ <param pos="1" name="host.name"/>
543
+ <param pos="2" name="service.version"/>
544
+ </fingerprint>
545
+ <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Ready *$">
546
+ <description>Rockliffe MailSite - without version (http://www.rockliffe.com)</description>
547
+ <example host.name="foo.bar">foo.bar MailSite SMTP Receiver Ready</example>
548
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
549
+ <param pos="0" name="service.family" value="MailSite"/>
550
+ <param pos="0" name="service.product" value="MailSite"/>
551
+ <param pos="1" name="host.name"/>
552
+ </fingerprint>
553
+ <fingerprint pattern="^ ?MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
554
+ <description>Rockliffe MailSite - without hostname (http://www.rockliffe.com)</description>
555
+ <example service.version="10.2.0.0"> MailSite ESMTP Receiver Version 10.2.0.0 Ready</example>
556
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
557
+ <param pos="0" name="service.family" value="MailSite"/>
558
+ <param pos="0" name="service.product" value="MailSite"/>
559
+ <param pos="1" name="service.version"/>
560
+ </fingerprint>
561
+ <fingerprint pattern="^([^ ]+) +MAILsweeper ESMTP Receiver Version (\d\.[\d.]+) Ready *$">
562
+ <description>Content Security MAILsweeper for SMTP (http://www.contenttechnologies.com/products/msw4smtp/default.asp)</description>
563
+ <example service.version="4.2.1.0">foo.bar MAILsweeper ESMTP Receiver Version 4.2.1.0 Ready</example>
564
+ <param pos="0" name="service.vendor" value="Clearswift"/>
565
+ <param pos="0" name="service.family" value="MAILsweeper"/>
566
+ <param pos="0" name="service.product" value="MAILsweeper"/>
567
+ <param pos="1" name="host.name"/>
568
+ <param pos="2" name="service.version"/>
569
+ </fingerprint>
570
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) UNREGISTERED; *(.+) *$">
571
+ <description>MDaemon mail server - with timestamp, unregistered</description>
572
+ <example service.version="4.0.5">foo.bar ESMTP MDaemon 4.0.5 UNREGISTERED; Sat, 06 Oct 2001 09:10:56 +0400</example>
573
+ <param pos="0" name="service.vendor" value="Alt-N"/>
574
+ <param pos="0" name="service.family" value="MDaemon"/>
575
+ <param pos="0" name="service.product" value="MDaemon"/>
576
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
577
+ <param pos="0" name="mdaemon.unregistered" value="yes"/>
578
+ <param pos="0" name="os.vendor" value="Microsoft"/>
579
+ <param pos="0" name="os.family" value="Windows"/>
580
+ <param pos="0" name="os.product" value="Windows"/>
581
+ <param pos="0" name="os.arch" value="x86"/>
582
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
583
+ <param pos="1" name="host.name"/>
584
+ <param pos="2" name="service.version"/>
585
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
586
+ <param pos="3" name="system.time"/>
587
+ </fingerprint>
588
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
589
+ <description>MDaemon mail server - with timestamp</description>
590
+ <example service.version="4.0.2">foo.bar ESMTP MDaemon 4.0.2; Sat, 06 Oct 2001 01:46:44 -0500</example>
591
+ <param pos="0" name="service.vendor" value="Alt-N"/>
592
+ <param pos="0" name="service.family" value="MDaemon"/>
593
+ <param pos="0" name="service.product" value="MDaemon"/>
594
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
595
+ <param pos="0" name="os.vendor" value="Microsoft"/>
596
+ <param pos="0" name="os.family" value="Windows"/>
597
+ <param pos="0" name="os.product" value="Windows"/>
598
+ <param pos="0" name="os.arch" value="x86"/>
599
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
600
+ <param pos="1" name="host.name"/>
601
+ <param pos="2" name="service.version"/>
602
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
603
+ <param pos="3" name="system.time"/>
604
+ </fingerprint>
605
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
606
+ <description>MDaemon mail server - without timestamp</description>
607
+ <example service.version="3.5.7">foo.bar ESMTP MDaemon 3.5.7 ready</example>
608
+ <param pos="0" name="service.vendor" value="Alt-N"/>
609
+ <param pos="0" name="service.family" value="MDaemon"/>
610
+ <param pos="0" name="service.product" value="MDaemon"/>
611
+ <param pos="0" name="os.vendor" value="Microsoft"/>
612
+ <param pos="0" name="os.family" value="Windows"/>
613
+ <param pos="0" name="os.product" value="Windows"/>
614
+ <param pos="0" name="os.arch" value="x86"/>
615
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
616
+ <param pos="1" name="host.name"/>
617
+ <param pos="2" name="service.version"/>
618
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
619
+ </fingerprint>
620
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:using )?MDaemon v(\d+\.[\d.]+) ([^ ]+) *$">
621
+ <description>MDaemon mail server - with version revision</description>
622
+ <example service.version="2.84" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.84 R</example>
623
+ <example service.version="3.0.3" service.version.version="R">foo.bar ESMTP service ready [1] using MDaemon v3.0.3 R</example>
624
+ <example service.version="2.8.7.0" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.8.7.0 R</example>
625
+ <param pos="0" name="service.vendor" value="Alt-N"/>
626
+ <param pos="0" name="service.family" value="MDaemon"/>
627
+ <param pos="0" name="service.product" value="MDaemon"/>
628
+ <param pos="0" name="os.vendor" value="Microsoft"/>
629
+ <param pos="0" name="os.family" value="Windows"/>
630
+ <param pos="0" name="os.product" value="Windows"/>
631
+ <param pos="0" name="os.arch" value="x86"/>
632
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
633
+ <param pos="1" name="host.name"/>
634
+ <param pos="2" name="service.version"/>
635
+ <param pos="3" name="service.version.version"/>
636
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
637
+ </fingerprint>
638
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:\()?MDaemon v([\d.]+) ([^ ]+) ([^ )]+)(?:\))? *$">
639
+ <description>MDaemon mail server - with service pack</description>
640
+ <example service.version="2.7" service.version.version="SP5" service.version.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.7 SP5 R</example>
641
+ <example service.version="2.7" service.version.version="SP4" service.version.version.version="R">foo.bar ESMTP service ready [1] (MDaemon v2.7 SP4 R)</example>
642
+ <param pos="0" name="service.vendor" value="Alt-N"/>
643
+ <param pos="0" name="service.family" value="MDaemon"/>
644
+ <param pos="0" name="service.product" value="MDaemon"/>
645
+ <param pos="0" name="os.vendor" value="Microsoft"/>
646
+ <param pos="0" name="os.family" value="Windows"/>
647
+ <param pos="0" name="os.product" value="Windows"/>
648
+ <param pos="0" name="os.arch" value="x86"/>
649
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
650
+ <param pos="1" name="host.name"/>
651
+ <param pos="2" name="service.version"/>
652
+ <param pos="3" name="service.version.version"/>
653
+ <param pos="4" name="service.version.version.version"/>
654
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
655
+ </fingerprint>
656
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
657
+ <description>MDaemon mail server</description>
658
+ <example service.version="2.5" service.version.version.version="b1">foo.bar ESMTP service ready [1] (MDaemon v2.5 rB b1 32-T)</example>
659
+ <param pos="0" name="service.vendor" value="Alt-N"/>
660
+ <param pos="0" name="service.family" value="MDaemon"/>
661
+ <param pos="0" name="service.product" value="MDaemon"/>
662
+ <param pos="0" name="os.vendor" value="Microsoft"/>
663
+ <param pos="0" name="os.family" value="Windows"/>
664
+ <param pos="0" name="os.product" value="Windows"/>
665
+ <param pos="0" name="os.arch" value="x86"/>
666
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
667
+ <param pos="1" name="host.name"/>
668
+ <param pos="2" name="service.version"/>
669
+ <param pos="3" name="service.version.version"/>
670
+ <param pos="4" name="service.version.version.version"/>
671
+ <param pos="5" name="service.version.version.version.version"/>
672
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
673
+ </fingerprint>
674
+ <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
675
+ <fingerprint pattern="^([^ ]+) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
676
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
677
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar SMTP Merak 8.0.3; Thu, 30 Nov 2017 20:01:41 +1000</example>
678
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar ESMTP Merak 8.0.3; Thu, 30 Nov 2017 12:08:09 +0200</example>
679
+ <example host.name="foo.bar" service.version="2.10.284">foo.bar ESMTP MERAK 2.10.284; Thu, 30 Nov 2017 17:55:10 +0800</example>
680
+ <param pos="0" name="service.vendor" value="Merak"/>
681
+ <param pos="0" name="service.family" value="Mail Server"/>
682
+ <param pos="0" name="service.product" value="Mail Server"/>
683
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
684
+ <param pos="1" name="host.name"/>
685
+ <param pos="2" name="service.version"/>
686
+ <param pos="3" name="system.time"/>
687
+ </fingerprint>
688
+ <fingerprint pattern="^MERCUR SMTP-Server \(v([^ ]+\.[^ ])0\.([^ ]+) ([^ ]+)\) for (.+) ready at (.+) *$">
689
+ <description>Atrium's MERCUR SMTP server (http://www.atrium-software.com/pub/support_e.cfm)</description>
690
+ <example service.version="3.3" service.version.version="09" service.version.version.version="SA-0000005" mercur.os.info="Windows NT">MERCUR SMTP-Server (v3.30.09 SA-0000005) for Windows NT ready at Thu, 30 Nov 2017 10:01:06 +0100</example>
691
+ <param pos="0" name="service.vendor" value="Atrium Software"/>
692
+ <param pos="0" name="service.family" value="MERCUR"/>
693
+ <param pos="0" name="service.product" value="MERCUR"/>
694
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
695
+ <param pos="1" name="service.version"/>
696
+ <param pos="2" name="service.version.version"/>
697
+ <param pos="3" name="service.version.version.version"/>
698
+ <param pos="4" name="mercur.os.info"/>
699
+ <param pos="5" name="system.time"/>
700
+ </fingerprint>
701
+ <fingerprint pattern="^([^ ]+) Mercury ([^ ]+\.[^ ]+) ESMTP server ready.$">
702
+ <description>Mercury NLM for Netware ( http://www.pmail.com/index.cfm )</description>
703
+ <example service.version="1.43">foo.bar Mercury 1.43 ESMTP server ready.</example>
704
+ <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
705
+ <param pos="0" name="service.product" value="Mercury Mail Transport System"/>
706
+ <param pos="0" name="os.vendor" value="Novell"/>
707
+ <param pos="0" name="os.family" value="NetWare"/>
708
+ <param pos="0" name="os.product" value="NetWare"/>
709
+ <param pos="0" name="os.cpe23" value="cpe:/o:novell:netware:-"/>
710
+ <param pos="1" name="host.name"/>
711
+ <param pos="2" name="service.version"/>
712
+ </fingerprint>
713
+ <fingerprint pattern="^^([^ ]+) Mercury\/32 v([^ ]+\.[^ ]+) (?:SMTP\/)?ESMTP server ready.?$">
714
+ <description>Mercury/32 for Win9x/NT/2000 ( http://www.pmail.com/index.cfm )</description>
715
+ <example service.version="3.01a">foo.bar Mercury/32 v3.01a SMTP/ESMTP server ready.</example>
716
+ <example service.version="3.30">foo.bar Mercury/32 v3.30 ESMTP server ready.</example>
717
+ <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
718
+ <param pos="0" name="service.product" value="Mercury Mail Transport System"/>
719
+ <param pos="0" name="os.vendor" value="Microsoft"/>
720
+ <param pos="0" name="os.family" value="Windows"/>
721
+ <param pos="0" name="os.product" value="Windows"/>
722
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
723
+ <param pos="1" name="host.name"/>
724
+ <param pos="2" name="service.version"/>
725
+ </fingerprint>
726
+ <fingerprint pattern="^([^ ]+) SMTP NAVIEG ([^ ]+\.[^ ]+\.[^ ]+); (.+)* http.*$">
727
+ <description>Norton Antivirus for Internet Email Gateways (becomes NAVGW in 2.1)</description>
728
+ <example host.name="foo.bar" service.version="2.0.1">foo.bar SMTP NAVIEG 2.0.1; Sun, 29 Jul 2001 22:02:16 -0500 http://www.symantec.com</example>
729
+ <param pos="0" name="service.vendor" value="Norton"/>
730
+ <param pos="0" name="service.family" value="Antivirus for Gateways"/>
731
+ <param pos="0" name="service.product" value="Antivirus for Gateways"/>
732
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
733
+ <param pos="1" name="host.name"/>
734
+ <param pos="2" name="service.version"/>
735
+ <param pos="3" name="system.time"/>
736
+ </fingerprint>
737
+ <fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+) Patch ([^ ]+).*$">
738
+ <description>Netscape Messaging Server - with patch number</description>
739
+ <example host.name="foo.bar" service.version="4.15" service.version.version="7">foo.bar ESMTP service (Netscape Messaging Server 4.15 Patch 7 (built Sep 12 2001))</example>
740
+ <param pos="0" name="service.vendor" value="Netscape"/>
741
+ <param pos="0" name="service.family" value="Messaging Server"/>
742
+ <param pos="0" name="service.product" value="Messaging Server"/>
743
+ <param pos="1" name="host.name"/>
744
+ <param pos="2" name="service.version"/>
745
+ <param pos="3" name="service.version.version"/>
746
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
747
+ </fingerprint>
748
+ <fingerprint pattern="^([^ ]+) ESMTP server \(Netscape Messaging Server - Version ([\d.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
749
+ <description>Netscape Messaging Server - w/o patch number</description>
750
+ <example host.name="foo.bar" service.version="3.6" system.time="Thu, 30 Nov 2017 04:19:10 -0500">foo.bar ESMTP server (Netscape Messaging Server - Version 3.6) ready Thu, 30 Nov 2017 04:19:10 -0500</example>
751
+ <param pos="0" name="service.vendor" value="Netscape"/>
752
+ <param pos="0" name="service.family" value="Messaging Server"/>
753
+ <param pos="0" name="service.product" value="Messaging Server"/>
754
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
755
+ <param pos="1" name="host.name"/>
756
+ <param pos="2" name="service.version"/>
757
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
758
+ <param pos="3" name="system.time"/>
759
+ </fingerprint>
760
+ <fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
761
+ <description>Lotus Notes 4 SMTP MTA</description>
762
+ <example host.name="foo.bar">foo.bar Lotus SMTP MTA Service Ready</example>
763
+ <param pos="0" name="service.vendor" value="Lotus"/>
764
+ <param pos="0" name="service.family" value="Lotus Domino"/>
765
+ <param pos="0" name="service.product" value="Lotus Domino"/>
766
+ <param pos="0" name="service.version" value="4"/>
767
+ <param pos="1" name="host.name"/>
768
+ </fingerprint>
769
+ <!-- Branding is muddy here, IBM bought Lotus in 1995, server product wasn't
770
+ named Domino until Dec 1996 w/ v 4.5. Seems to have started being
771
+ called IBM Domino as of v9.0 on product and in banners.
772
+ -->
773
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(Lotus Domino Release (\d+\.[\w.]+(?: FP\d+)?(?: HF\d+)?)(?: \(Intl\))?\) ready at (.+) *$">
774
+ <description>Lotus Domino SMTP MTA</description>
775
+ <example service.version="8.5">foo.bar ESMTP Service (Lotus Domino Release 8.5) ready at Thu, 30 Nov 2017 17:01:45 +0800</example>
776
+ <example service.version="8.5.3FP6 HF1944">foo.bar ESMTP Service (Lotus Domino Release 8.5.3FP6 HF1944) ready at Thu, 30 Nov 2017 17:17:43 +0800</example>
777
+ <example service.version="8.0.2 FP1 HF82">foo.bar ESMTP Service (Lotus Domino Release 8.0.2 FP1 HF82) ready at Thu, 5 Apr 2018 22:03:28 +0200</example>
778
+ <example service.version="5.0.13a"> foo.bar ESMTP Service (Lotus Domino Release 5.0.13a) ready at Thu, 16 Nov 2017 17:47:42 +0800</example>
779
+ <example service.version="7.0.4">foo.bar ESMTP Service (Lotus Domino Release 7.0.4) ready at Thu, 16 Nov 2017 18:28:36 +0900</example>
780
+ <example service.version="8.0.2FP2">foo.bar ESMTP Service (Lotus Domino Release 8.0.2FP2) ready at Thu, 16 Nov 2017 02:17:33 -0700</example>
781
+ <example service.version="8.5.3">foo.bar ESMTP Service (Lotus Domino Release 8.5.3) ready at Thu, 16 Nov 2017 17:52:21 +0800</example>
782
+ <example service.version="7.0"> ESMTP Service (Lotus Domino Release 7.0) ready at Thu, 30 Nov 2017 17:00:41 +0800</example>
783
+ <example host.name="foo.bar" service.version="5.0.1">foo.bar ESMTP Service (Lotus Domino Release 5.0.1 (Intl)) ready at Thu, 30 Nov 2017 12:38:43 +0300</example>
784
+ <param pos="0" name="service.vendor" value="IBM"/>
785
+ <param pos="0" name="service.family" value="Lotus Domino"/>
786
+ <param pos="0" name="service.product" value="Lotus Domino"/>
787
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
788
+ <param pos="1" name="host.name"/>
789
+ <param pos="2" name="service.version"/>
790
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
791
+ <param pos="3" name="system.time"/>
792
+ </fingerprint>
793
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(IBM Domino Release (\d+\.[\w.]+(?: HF\d+)?)\) ready at (.+) *$">
794
+ <description>IBM Domino SMTP MTA</description>
795
+ <example host.name="foo.bar" service.version="9.0.1FP8 HF475">foo.bar ESMTP Service (IBM Domino Release 9.0.1FP8 HF475) ready at Thu, 30 Nov 2017 17:55:48 +0900</example>
796
+ <example host.name="foo.bar" service.version="9.0.1"> foo.bar ESMTP Service (IBM Domino Release 9.0.1) ready at Thu, 30 Nov 2017 10:12:26 +0100</example>
797
+ <example service.version="9.0.1FP8"> ESMTP Service (IBM Domino Release 9.0.1FP8) ready at Thu, 30 Nov 2017 13:51:59 -0800</example>
798
+ <param pos="0" name="service.vendor" value="IBM"/>
799
+ <param pos="0" name="service.family" value="IBM Domino"/>
800
+ <param pos="0" name="service.product" value="IBM Domino"/>
801
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
802
+ <param pos="1" name="host.name"/>
803
+ <param pos="2" name="service.version"/>
804
+ <param pos="3" name="system.time"/>
805
+ </fingerprint>
806
+ <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Build (V?[\w.]+)\) ready at (.+) *$">
807
+ <description>Lotus Domino (some early build)</description>
808
+ <example notes.build.version="166.1">foo.bar ESMTP Service (Lotus Domino Build 166.1) ready at Thu, 16 Nov 2017 10:39:22 +0200</example>
809
+ <example notes.build.version="V85_M2_08202008">foo.bar ESMTP Service (Lotus Domino Build V85_M2_08202008) ready at Thu, 16 Nov 2017 03:57:40 -0500</example>
810
+ <param pos="0" name="service.vendor" value="Lotus"/>
811
+ <param pos="0" name="service.family" value="Lotus Domino"/>
812
+ <param pos="0" name="service.product" value="Lotus Domino"/>
813
+ <param pos="1" name="host.name"/>
814
+ <param pos="2" name="notes.build.version"/>
815
+ <param pos="3" name="system.time"/>
816
+ </fingerprint>
817
+ <fingerprint pattern="^Lotus Notes ESMTP Server X[^ ]+\.[^ ]+ on (.+) ready at (.+)\. *$">
818
+ <description>Lotus Notes 4.x with SMTP MTA add-on</description>
819
+ <example host.name="FooBar R45 Server/Foo Bar/US" system.time="Fri, 15 Feb 2002 09:46:19 -0800">Lotus Notes ESMTP Server X1.0 on FooBar R45 Server/Foo Bar/US ready at Fri, 15 Feb 2002 09:46:19 -0800.</example>
820
+ <param pos="0" name="service.vendor" value="Lotus"/>
821
+ <param pos="0" name="service.family" value="Lotus Domino"/>
822
+ <param pos="0" name="service.product" value="Lotus Domino"/>
823
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
824
+ <param pos="1" name="host.name"/>
825
+ <param pos="2" name="system.time"/>
826
+ </fingerprint>
827
+ <fingerprint pattern="^([^ ]+) NTMail \(v(\d+\.\d+\.\d+)/([^ ]+)\) ready for ESMTP transfer *$">
828
+ <description>NTMail (http://www.gordano.com)</description>
829
+ <example host.name="foo.bar" service.version="7.02.3037" ntmail.id="NU1319.01.5b000000">foo.bar NTMail (v7.02.3037/NU1319.01.5b000000) ready for ESMTP transfer </example>
830
+ <param pos="0" name="service.vendor" value="Gordano"/>
831
+ <param pos="0" name="service.family" value="NTMail"/>
832
+ <param pos="0" name="service.product" value="NTMail"/>
833
+ <param pos="1" name="host.name"/>
834
+ <param pos="2" name="service.version"/>
835
+ <param pos="3" name="ntmail.id"/>
836
+ </fingerprint>
837
+ <fingerprint pattern="^([^ ]+) WindowsNT SMTP Server v([^ ]+\.[^ ]+\.[^ ]+)/([^ ]+)/SP ESMTP ready at (.+) *$">
838
+ <description>NTMail - versions 3.x and earlier (it was called Internet Shopper's something or other)</description>
839
+ <example host.name="foo.bar" service.version="3.03.0018" ntmail.id="7.aavn">foo.bar WindowsNT SMTP Server v3.03.0018/7.aavn/SP ESMTP ready at Thu, 30 Nov 2017 10:15:31 +0100</example>
840
+ <param pos="0" name="service.vendor" value="Gordano"/>
841
+ <param pos="0" name="service.family" value="NTMail"/>
842
+ <param pos="0" name="service.product" value="NTMail"/>
843
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
844
+ <param pos="1" name="host.name"/>
845
+ <param pos="2" name="service.version"/>
846
+ <param pos="3" name="ntmail.id"/>
847
+ <param pos="4" name="system.time"/>
848
+ </fingerprint>
849
+ <fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
850
+ <description>Some unknown mail server on OpenVMS</description>
851
+ <example host.name="foo.bar" os.arch="IA64" os.version="8.4">foo.bar V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
852
+ <example host.name="foo.bar" os.arch="Alpha" os.version="7.3-2">foo.bar V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
853
+ <example host.name="foo.bar" os.arch="VAX" os.version="6.2">foo.bar UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
854
+ <example host.name="foo.bar" os.arch="Alpha" os.version="6.2-1H3">foo.bar UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
855
+ <param pos="1" name="host.name"/>
856
+ <param pos="0" name="os.vendor" value="HP"/>
857
+ <param pos="0" name="os.family" value="OpenVMS"/>
858
+ <param pos="0" name="os.product" value="OpenVMS"/>
859
+ <param pos="2" name="os.version"/>
860
+ <param pos="3" name="os.arch"/>
861
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:openvms:{os.version}"/>
862
+ </fingerprint>
863
+ <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\])? ([\d\.]+); (\w\w\w, +\d+ \w\w\w \d\d\d\d [\d:]+)$">
864
+ <description>A.K.I PMail</description>
865
+ <example host.name="foo.bar" service.version="1.91">foo.bar ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
866
+ <example host.name="foo.bar" service.version="1.78">foo.bar ESMTP PMailServer 1.78; Fri, 6 Apr 2018 04:34:11</example>
867
+ <param pos="0" name="service.vendor" value="A.K.I Software"/>
868
+ <param pos="0" name="service.product" value="PMail Server"/>
869
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss"/>
870
+ <param pos="1" name="host.name"/>
871
+ <param pos="2" name="service.version"/>
872
+ <param pos="3" name="system.time"/>
873
+ </fingerprint>
874
+ <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
875
+ <description>Postfix - version + build, followed by os</description>
876
+ <param pos="0" name="service.family" value="Postfix"/>
877
+ <param pos="0" name="service.product" value="Postfix"/>
878
+ <param pos="1" name="host.name"/>
879
+ <param pos="2" name="service.version"/>
880
+ <param pos="3" name="service.version.version"/>
881
+ <param pos="4" name="postfix.os.info"/>
882
+ </fingerprint>
883
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \(?([\d.]+)\)?$">
884
+ <description>Postfix - Std semantic versioning, w/ optional parens</description>
885
+ <example service.version="3.1.4">foo.bar ESMTP Postfix (3.1.4)</example>
886
+ <example service.version="2.7.1">foo.bar ESMTP Postfix 2.7.1</example>
887
+ <param pos="0" name="service.family" value="Postfix"/>
888
+ <param pos="0" name="service.product" value="Postfix"/>
889
+ <param pos="1" name="host.name"/>
890
+ <param pos="2" name="service.version"/>
891
+ </fingerprint>
892
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \((?:Postfix-)?([\d.]+)-([^ ]+)\)$">
893
+ <description>Postfix - version + build</description>
894
+ <example service.version="2.8" service.version.version="20100306">foo.bar ESMTP Postfix (2.8-20100306)</example>
895
+ <param pos="0" name="service.family" value="Postfix"/>
896
+ <param pos="0" name="service.product" value="Postfix"/>
897
+ <param pos="1" name="host.name"/>
898
+ <param pos="2" name="service.version"/>
899
+ <param pos="3" name="service.version.version"/>
900
+ </fingerprint>
901
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Ubuntu\)$">
902
+ <description>Postfix - Ubuntu</description>
903
+ <example>foo.bar ESMTP Postfix (Ubuntu)</example>
904
+ <param pos="0" name="service.family" value="Postfix"/>
905
+ <param pos="0" name="service.product" value="Postfix"/>
906
+ <param pos="1" name="host.name"/>
907
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
908
+ <param pos="0" name="os.family" value="Linux"/>
909
+ <param pos="0" name="os.product" value="Linux"/>
910
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
911
+ </fingerprint>
912
+ <fingerprint pattern="^([^ ]+)(?: ESMTP)? Hi, I'm a Mail-in-a-Box \(Ubuntu/Postfix; see https://mailinabox.email/\)$">
913
+ <description>Postfix - Ubuntu, Mail-in-a-Box package</description>
914
+ <example>foo.bar ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
915
+ <example>foo.bar Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
916
+ <param pos="0" name="service.family" value="Postfix"/>
917
+ <param pos="0" name="service.product" value="Postfix"/>
918
+ <param pos="1" name="host.name"/>
919
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
920
+ <param pos="0" name="os.family" value="Linux"/>
921
+ <param pos="0" name="os.product" value="Linux"/>
922
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
923
+ </fingerprint>
924
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Debian/GNU\)$">
925
+ <description>Postfix - Debian</description>
926
+ <example>foo.bar ESMTP Postfix (Debian/GNU)</example>
927
+ <param pos="0" name="service.family" value="Postfix"/>
928
+ <param pos="0" name="service.product" value="Postfix"/>
929
+ <param pos="1" name="host.name"/>
930
+ <param pos="0" name="os.vendor" value="Debian"/>
931
+ <param pos="0" name="os.family" value="Linux"/>
932
+ <param pos="0" name="os.product" value="Linux"/>
933
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
934
+ </fingerprint>
935
+ <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
936
+ <description>Postfix - generic banner with amusing comments in parentheses</description>
937
+ <example>foo.bar ESMTP Postfix (lol)</example>
938
+ <param pos="0" name="service.family" value="Postfix"/>
939
+ <param pos="0" name="service.product" value="Postfix"/>
940
+ <param pos="1" name="host.name"/>
941
+ </fingerprint>
942
+ <fingerprint pattern="^(?i)([^ ]+) +E?SMTP.* Postfix *$">
943
+ <description>Postfix - generic banner</description>
944
+ <example>foo.bar ESMTP Postfix</example>
945
+ <example>foo.bar SMTP Postfix</example>
946
+ <param pos="0" name="service.family" value="Postfix"/>
947
+ <param pos="0" name="service.product" value="Postfix"/>
948
+ <param pos="1" name="host.name"/>
949
+ </fingerprint>
950
+ <fingerprint pattern="^ *ESMTP Postfix$">
951
+ <description>Postfix - banner without hostname or version</description>
952
+ <example>ESMTP Postfix</example>
953
+ <param pos="0" name="service.family" value="Postfix"/>
954
+ <param pos="0" name="service.product" value="Postfix"/>
955
+ </fingerprint>
956
+ <fingerprint pattern="^(?i)([^ ]+) POSTFIX$">
957
+ <description>Postfix - generic w/o ESMTP</description>
958
+ <example host.name="foo.bar">foo.bar Postfix</example>
959
+ <param pos="0" name="service.family" value="Postfix"/>
960
+ <param pos="0" name="service.product" value="Postfix"/>
961
+ <param pos="1" name="host.name"/>
962
+ </fingerprint>
963
+ <fingerprint pattern="^([^ ]+) ESMTP server \((?i:P)ost\.(?i:O)ffice v([^ ]+\.[^ ]+)(?: release)? (.+) ID# ([^ ]+)\) ready (.+) *$">
964
+ <description>Post.Office</description>
965
+ <example host.name="foo.bar" service.version="3.8.4" postoffice.build="116" postoffice.id="1001-65749U100L10S0V38" system.time="Thu, 30 Nov 2017 18:46:24 +0900">foo.bar ESMTP server (post.office v3.8.4 release 116 ID# 1001-65749U100L10S0V38) ready Thu, 30 Nov 2017 18:46:24 +0900</example>
966
+ <example host.name="foo.bar" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">foo.bar ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>
967
+ <param pos="0" name="service.family" value="Post.Office"/>
968
+ <param pos="0" name="service.product" value="Post.Office"/>
969
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
970
+ <param pos="1" name="host.name"/>
971
+ <param pos="2" name="service.version"/>
972
+ <param pos="3" name="postoffice.build"/>
973
+ <param pos="4" name="postoffice.id"/>
974
+ <param pos="5" name="system.time"/>
975
+ </fingerprint>
976
+ <fingerprint pattern="^([^ ]+) Generic SMTP handler *$">
977
+ <description>Raptor Firewall (low confidence)</description>
978
+ <example host.name="foo.bar">foo.bar Generic SMTP handler</example>
979
+ <param pos="0" name="service.product" value="raptor"/>
980
+ <param pos="1" name="host.name"/>
981
+ </fingerprint>
982
+ <fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
983
+ <description>SAP SMTP Server</description>
984
+ <example host.name="foo.bar" service.version="8.04(53)">foo.bar SAP 8.04(53) ESMTP service ready</example>
985
+ <param pos="0" name="service.vendor" value="SAP"/>
986
+ <param pos="0" name="service.product" value="SMTP"/>
987
+ <param pos="2" name="service.version"/>
988
+ <param pos="1" name="host.name"/>
989
+ </fingerprint>
990
+ <fingerprint pattern="^Sendmail ESMTP ready$">
991
+ <description>Sendmail - short banner w/o hostname, version, platform, or date.</description>
992
+ <example>Sendmail ESMTP ready</example>
993
+ <param pos="0" name="service.family" value="Sendmail"/>
994
+ <param pos="0" name="service.product" value="Sendmail"/>
995
+ </fingerprint>
996
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
997
+ <description>Sendmail - HP-UX with a PHNE (HP Networking patch) installed</description>
998
+ <example host.name="foo.bar" service.version="8.8.6" sendmail.config.version="8.7.1">foo.bar ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT)</example>
999
+ <param pos="0" name="service.family" value="Sendmail"/>
1000
+ <param pos="0" name="service.product" value="Sendmail"/>
1001
+ <param pos="0" name="os.vendor" value="HP"/>
1002
+ <param pos="0" name="os.family" value="HP-UX"/>
1003
+ <param pos="0" name="os.product" value="HP-UX"/>
1004
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
1005
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1006
+ <param pos="1" name="host.name"/>
1007
+ <param pos="2" name="service.version"/>
1008
+ <param pos="3" name="sendmail.hpux.phne.version"/>
1009
+ <param pos="4" name="sendmail.config.version"/>
1010
+ <param pos="5" name="system.time"/>
1011
+ </fingerprint>
1012
+ <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w\w\w)$">
1013
+ <description>Sendmail - HP-UX</description>
1014
+ <example host.name="foo.bar" os.version="11.31" service.version="8.13.3">foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
1015
+ <param pos="0" name="service.family" value="Sendmail"/>
1016
+ <param pos="0" name="service.product" value="Sendmail"/>
1017
+ <param pos="0" name="os.vendor" value="HP"/>
1018
+ <param pos="0" name="os.family" value="HP-UX"/>
1019
+ <param pos="0" name="os.product" value="HP-UX"/>
1020
+ <param pos="3" name="os.version"/>
1021
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
1022
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1023
+ <param pos="1" name="host.name"/>
1024
+ <param pos="2" name="service.version"/>
1025
+ <param pos="4" name="system.time"/>
1026
+ </fingerprint>
1027
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
1028
+ <description>Sendmail - Unixware</description>
1029
+ <example service.version="8.8.7">foo.bar ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300)</example>
1030
+ <param pos="0" name="service.family" value="Sendmail"/>
1031
+ <param pos="0" name="service.product" value="Sendmail"/>
1032
+ <param pos="0" name="os.vendor" value="SCO"/>
1033
+ <param pos="0" name="os.family" value="UnixWare"/>
1034
+ <param pos="0" name="os.product" value="UnixWare"/>
1035
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1036
+ <param pos="1" name="host.name"/>
1037
+ <param pos="2" name="service.version"/>
1038
+ <param pos="3" name="os.version"/>
1039
+ <param pos="4" name="system.time"/>
1040
+ </fingerprint>
1041
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/UCB ([^;]+); (.+) \(.+\)$">
1042
+ <description>Sendmail - AIX (UCB variant)</description>
1043
+ <example os.version="4.2" service.version="8.7">foo.bar ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1044
+ <param pos="0" name="service.family" value="Sendmail"/>
1045
+ <param pos="0" name="service.product" value="Sendmail"/>
1046
+ <param pos="0" name="os.vendor" value="IBM"/>
1047
+ <param pos="0" name="os.family" value="AIX"/>
1048
+ <param pos="0" name="os.product" value="AIX"/>
1049
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1050
+ <param pos="1" name="host.name"/>
1051
+ <param pos="2" name="os.version"/>
1052
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1053
+ <param pos="3" name="service.version"/>
1054
+ <param pos="4" name="system.time"/>
1055
+ </fingerprint>
1056
+ <fingerprint pattern="^([^ ]+) Sendmail AIX([^/]+)/UCB ([^/]+)/([^ ]+) ready at (.+)$">
1057
+ <description>Sendmail - AIX (UCB/ready at variant)</description>
1058
+ <example>foo.bar Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500</example>
1059
+ <param pos="0" name="service.family" value="Sendmail"/>
1060
+ <param pos="0" name="service.product" value="Sendmail"/>
1061
+ <param pos="0" name="os.vendor" value="IBM"/>
1062
+ <param pos="0" name="os.family" value="AIX"/>
1063
+ <param pos="0" name="os.product" value="AIX"/>
1064
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1065
+ <param pos="1" name="host.name"/>
1066
+ <param pos="2" name="os.version"/>
1067
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1068
+ <param pos="3" name="service.version"/>
1069
+ <param pos="4" name="sendmail.config.version"/>
1070
+ <param pos="5" name="system.time"/>
1071
+ </fingerprint>
1072
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+)(?: \(.+\))?$">
1073
+ <description>Sendmail - AIX</description>
1074
+ <example host.name="foo.bar" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">foo.bar ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1075
+ <example host.name="foo.bar" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">foo.bar ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
1076
+ <param pos="0" name="service.family" value="Sendmail"/>
1077
+ <param pos="0" name="service.product" value="Sendmail"/>
1078
+ <param pos="0" name="os.vendor" value="IBM"/>
1079
+ <param pos="0" name="os.family" value="AIX"/>
1080
+ <param pos="0" name="os.product" value="AIX"/>
1081
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1082
+ <param pos="1" name="host.name"/>
1083
+ <param pos="2" name="os.version"/>
1084
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1085
+ <param pos="3" name="service.version"/>
1086
+ <param pos="4" name="sendmail.config.version"/>
1087
+ <param pos="5" name="system.time"/>
1088
+ </fingerprint>
1089
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/SuSE Linux ([^;]+); (.+)$">
1090
+ <description>Sendmail - SuSE Linux</description>
1091
+ <example>foo.bar ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200</example>
1092
+ <param pos="0" name="service.family" value="Sendmail"/>
1093
+ <param pos="0" name="service.product" value="Sendmail"/>
1094
+ <param pos="0" name="os.vendor" value="SuSE"/>
1095
+ <param pos="0" name="os.family" value="Linux"/>
1096
+ <param pos="0" name="os.product" value="Linux"/>
1097
+ <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:-"/>
1098
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1099
+ <param pos="1" name="host.name"/>
1100
+ <param pos="2" name="service.version"/>
1101
+ <param pos="3" name="sendmail.config.version"/>
1102
+ <param pos="4" name="sendmail.vendor.version"/>
1103
+ <param pos="5" name="system.time"/>
1104
+ </fingerprint>
1105
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+); (.+)$">
1106
+ <description>Sendmail - Solaris with date (no time offeset variant)</description>
1107
+ <example>foo.bar ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT</example>
1108
+ <param pos="0" name="service.family" value="Sendmail"/>
1109
+ <param pos="0" name="service.product" value="Sendmail"/>
1110
+ <param pos="0" name="os.vendor" value="Sun"/>
1111
+ <param pos="0" name="os.family" value="Solaris"/>
1112
+ <param pos="0" name="os.product" value="Solaris"/>
1113
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1114
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1115
+ <param pos="1" name="host.name"/>
1116
+ <param pos="2" name="service.version"/>
1117
+ <param pos="3" name="sendmail.config.version"/>
1118
+ <param pos="4" name="system.time"/>
1119
+ </fingerprint>
1120
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+) ready at (.+) \(.+\)$">
1121
+ <description>Sendmail - Solaris with date (ready variant)</description>
1122
+ <example>foo.bar ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST)</example>
1123
+ <param pos="0" name="service.family" value="Sendmail"/>
1124
+ <param pos="0" name="service.product" value="Sendmail"/>
1125
+ <param pos="0" name="os.vendor" value="Sun"/>
1126
+ <param pos="0" name="os.family" value="Solaris"/>
1127
+ <param pos="0" name="os.product" value="Solaris"/>
1128
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1129
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1130
+ <param pos="1" name="host.name"/>
1131
+ <param pos="2" name="service.version"/>
1132
+ <param pos="3" name="sendmail.config.version"/>
1133
+ <param pos="4" name="system.time"/>
1134
+ </fingerprint>
1135
+ <fingerprint pattern="^([^ ]+) ESMTP (?:Debian )?Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
1136
+ <description>Sendmail - Debian</description>
1137
+ <example service.version="8.12.0.Beta7" sendmail.config.version="8.12.0.Beta7" sendmail.vendor.version="8.12.0.Beta7-1">foo.bar ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800</example>
1138
+ <example service.version="8.11.0" sendmail.config.version="8.9.3" sendmail.vendor.version="8.9.3-21">foo.bar ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700</example>
1139
+ <param pos="0" name="service.family" value="Sendmail"/>
1140
+ <param pos="0" name="service.product" value="Sendmail"/>
1141
+ <param pos="0" name="os.vendor" value="Debian"/>
1142
+ <param pos="0" name="os.family" value="Linux"/>
1143
+ <param pos="0" name="os.product" value="Linux"/>
1144
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1145
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1146
+ <param pos="1" name="host.name"/>
1147
+ <param pos="2" name="service.version"/>
1148
+ <param pos="3" name="sendmail.config.version"/>
1149
+ <param pos="4" name="sendmail.vendor.version"/>
1150
+ <param pos="5" name="system.time"/>
1151
+ </fingerprint>
1152
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+(?:wheezy|deb7u)\d; (.+); .*$">
1153
+ <description>Sendmail - Debian 7.x (wheezy)</description>
1154
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+wheezy1; Thu, 30 Nov 2017 10:33:05 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1155
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+deb7u1; Thu, 30 Nov 2017 11:00:33 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1156
+ <param pos="0" name="service.family" value="Sendmail"/>
1157
+ <param pos="0" name="service.product" value="Sendmail"/>
1158
+ <param pos="0" name="os.vendor" value="Debian"/>
1159
+ <param pos="0" name="os.family" value="Linux"/>
1160
+ <param pos="0" name="os.product" value="Linux"/>
1161
+ <param pos="0" name="os.version" value="7.0"/>
1162
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
1163
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1164
+ <param pos="1" name="host.name"/>
1165
+ <param pos="2" name="service.version"/>
1166
+ <param pos="3" name="sendmail.config.version"/>
1167
+ <param pos="4" name="system.time"/>
1168
+ </fingerprint>
1169
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+deb8u\d; (.+); .*$">
1170
+ <description>Sendmail - Debian 8.x (jessie)</description>
1171
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-8+deb8u2; Thu, 30 Nov 2017 10:25:48 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1172
+ <param pos="0" name="service.family" value="Sendmail"/>
1173
+ <param pos="0" name="service.product" value="Sendmail"/>
1174
+ <param pos="0" name="os.vendor" value="Debian"/>
1175
+ <param pos="0" name="os.family" value="Linux"/>
1176
+ <param pos="0" name="os.product" value="Linux"/>
1177
+ <param pos="0" name="os.version" value="8.0"/>
1178
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
1179
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1180
+ <param pos="1" name="host.name"/>
1181
+ <param pos="2" name="service.version"/>
1182
+ <param pos="3" name="sendmail.config.version"/>
1183
+ <param pos="4" name="system.time"/>
1184
+ </fingerprint>
1185
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+lenny\d; (.+); .*$">
1186
+ <description>Sendmail - Debian 5.x (lenny)</description>
1187
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-5+lenny1; Thu, 30 Nov 2017 12:29:40 +0300; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1188
+ <param pos="0" name="service.family" value="Sendmail"/>
1189
+ <param pos="0" name="service.product" value="Sendmail"/>
1190
+ <param pos="0" name="os.vendor" value="Debian"/>
1191
+ <param pos="0" name="os.family" value="Linux"/>
1192
+ <param pos="0" name="os.product" value="Linux"/>
1193
+ <param pos="0" name="os.version" value="5.0"/>
1194
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
1195
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1196
+ <param pos="1" name="host.name"/>
1197
+ <param pos="2" name="service.version"/>
1198
+ <param pos="3" name="sendmail.config.version"/>
1199
+ <param pos="4" name="system.time"/>
1200
+ </fingerprint>
1201
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+etch\d; (.+); .*$">
1202
+ <description>Sendmail - Debian 4.x (etch)</description>
1203
+ <example service.version="8.13.8" sendmail.config.version="8.13.8">foo.bar ESMTP Sendmail 8.13.8/8.13.8/Debian-3+etch1; Thu, 30 Nov 2017 10:28:23 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1204
+ <param pos="0" name="service.family" value="Sendmail"/>
1205
+ <param pos="0" name="service.product" value="Sendmail"/>
1206
+ <param pos="0" name="os.vendor" value="Debian"/>
1207
+ <param pos="0" name="os.family" value="Linux"/>
1208
+ <param pos="0" name="os.product" value="Linux"/>
1209
+ <param pos="0" name="os.version" value="4.0"/>
1210
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
1211
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1212
+ <param pos="1" name="host.name"/>
1213
+ <param pos="2" name="service.version"/>
1214
+ <param pos="3" name="sendmail.config.version"/>
1215
+ <param pos="4" name="system.time"/>
1216
+ </fingerprint>
1217
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\dsarge\d; (.+); .*$">
1218
+ <description>Sendmail - Debian 3.1 (sarge)</description>
1219
+ <example service.version="8.13.4">foo.bar ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge1; Thu, 30 Nov 2017 10:55:47 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1220
+ <param pos="0" name="service.family" value="Sendmail"/>
1221
+ <param pos="0" name="service.product" value="Sendmail"/>
1222
+ <param pos="0" name="os.vendor" value="Debian"/>
1223
+ <param pos="0" name="os.family" value="Linux"/>
1224
+ <param pos="0" name="os.product" value="Linux"/>
1225
+ <param pos="0" name="os.version" value="3.1"/>
1226
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:3.1"/>
1227
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1228
+ <param pos="1" name="host.name"/>
1229
+ <param pos="2" name="service.version"/>
1230
+ <param pos="3" name="sendmail.config.version"/>
1231
+ <param pos="4" name="system.time"/>
1232
+ </fingerprint>
1233
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d(?:\.\d)?(?:build\d)?;+ (.+); .*$">
1234
+ <description>Sendmail - Debian patch only</description>
1235
+ <example service.version="8.15.2">foo.bar ESMTP Sendmail 8.15.2/8.15.2/Debian-3; Thu, 30 Nov 2017 10:55:50 +0200; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1236
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-9.4; Thu, 30 Nov 2017 10:11:54 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1237
+ <example service.version="8.14.2">foo.bar ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Thu, 30 Nov 2017 04:09:50 -0600; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1238
+ <param pos="0" name="service.family" value="Sendmail"/>
1239
+ <param pos="0" name="service.product" value="Sendmail"/>
1240
+ <param pos="0" name="os.vendor" value="Debian"/>
1241
+ <param pos="0" name="os.family" value="Linux"/>
1242
+ <param pos="0" name="os.product" value="Linux"/>
1243
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1244
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1245
+ <param pos="1" name="host.name"/>
1246
+ <param pos="2" name="service.version"/>
1247
+ <param pos="3" name="sendmail.config.version"/>
1248
+ <param pos="4" name="system.time"/>
1249
+ </fingerprint>
1250
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/[^/]+/Debian-[\d.]+ubuntu[^ ]*; (.+); .*$">
1251
+ <description>Sendmail - Ubuntu</description>
1252
+ <example service.version="8.13.5.20060308">foo.bar ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1253
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4.1ubuntu1; Thu, 30 Nov 2017 11:00:30 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1254
+ <param pos="0" name="service.family" value="Sendmail"/>
1255
+ <param pos="0" name="service.product" value="Sendmail"/>
1256
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1257
+ <param pos="0" name="os.family" value="Linux"/>
1258
+ <param pos="0" name="os.product" value="Linux"/>
1259
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
1260
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1261
+ <param pos="1" name="host.name"/>
1262
+ <param pos="2" name="service.version"/>
1263
+ <param pos="3" name="system.time"/>
1264
+ </fingerprint>
1265
+ <fingerprint pattern="^([^ ]+) (?:E?SMTP )?Sendmail SMI-([^/]+)/(SMI-SVR4) ready at (.+)$">
1266
+ <description>Sendmail - Solaris (SMI variant)</description>
1267
+ <example>foo.bar Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400</example>
1268
+ <param pos="0" name="service.family" value="Sendmail"/>
1269
+ <param pos="0" name="service.product" value="Sendmail"/>
1270
+ <param pos="0" name="os.vendor" value="Sun"/>
1271
+ <param pos="0" name="os.family" value="SunOS"/>
1272
+ <param pos="0" name="os.product" value="Solaris"/>
1273
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1274
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1275
+ <param pos="1" name="host.name"/>
1276
+ <param pos="2" name="service.version"/>
1277
+ <param pos="3" name="sendmail.config.version"/>
1278
+ <param pos="4" name="system.time"/>
1279
+ </fingerprint>
1280
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)/(linuxconf); (.+)$">
1281
+ <description>Sendmail - unknown platform (linuxconf variant)</description>
1282
+ <example>foo.bar ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400</example>
1283
+ <param pos="0" name="service.family" value="Sendmail"/>
1284
+ <param pos="0" name="service.product" value="Sendmail"/>
1285
+ <param pos="0" name="os.family" value="Linux"/>
1286
+ <param pos="0" name="os.product" value="Linux"/>
1287
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1288
+ <param pos="1" name="host.name"/>
1289
+ <param pos="2" name="service.version"/>
1290
+ <param pos="3" name="sendmail.config.version"/>
1291
+ <param pos="4" name="system.time"/>
1292
+ </fingerprint>
1293
+ <fingerprint pattern="^([^ ]+) ESMTP MetaInfo Sendmail ([^ ]+) Build ([^ ]+) \(Berkeley ([^ ]+)\)/([^;]+); (.+)$">
1294
+ <description>Sendmail - MetaInfo</description>
1295
+ <example host.name="foo.bar" service.version="8.8.6">foo.bar ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1296
+ <param pos="0" name="service.vendor" value="MetaInfo"/>
1297
+ <param pos="0" name="service.family" value="Sendmail"/>
1298
+ <param pos="0" name="service.product" value="Sendmail"/>
1299
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1300
+ <param pos="0" name="os.family" value="Windows"/>
1301
+ <param pos="0" name="os.product" value="Windows NT"/>
1302
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_nt:-"/>
1303
+ <param pos="0" name="system.time.format" value="EEE, d MMM"/>
1304
+ <param pos="1" name="host.name"/>
1305
+ <param pos="2" name="metainfo.version"/>
1306
+ <param pos="3" name="metainfo.version.version"/>
1307
+ <param pos="4" name="service.version"/>
1308
+ <param pos="5" name="sendmail.config.version"/>
1309
+ <param pos="6" name="system.time"/>
1310
+ </fingerprint>
1311
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1312
+ <description>Sendmail - optional timezone and timestamp, w/o OS</description>
1313
+ <example host.name="foo.bar" service.version="8.9.3+3.4W" sendmail.config.version="8.9.3+3.4W" system.time="Tue, 30 Jan 2001 20:40:09 -0500">foo.bar ESMTP Sendmail 8.9.3+3.4W/8.9.3+3.4W; Tue, 30 Jan 2001 20:40:09 -0500 (EST)</example>
1314
+ <example host.name="foo.bar" service.version="8.12.10" sendmail.config.version="8.12.10">foo.bar ESMTP Sendmail 8.12.10/8.12.10;</example>
1315
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1316
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1317
+ <example host.name="foo.bar" service.version="8.10.2" sendmail.config.version="8.10.3">foo.bar ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
1318
+ <example host.name="foo.bar" service.version="8.13.8" sendmail.config.version="8.13.9">foo.bar ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
1319
+ <param pos="0" name="service.product" value="Sendmail"/>
1320
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1321
+ <param pos="1" name="host.name"/>
1322
+ <param pos="2" name="service.version"/>
1323
+ <param pos="3" name="sendmail.config.version"/>
1324
+ <param pos="4" name="system.time"/>
1325
+ </fingerprint>
1326
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w+)\.?$">
1327
+ <description>Sendmail - with timezone and timestamp, w/o timezone offset or OS</description>
1328
+ <example host.name="foo.bar" service.version="8.14.4" sendmail.config.version="8.14.4" system.time="Thu, 5 Apr 2018 19:30:58 GMT">foo.bar ESMTP Sendmail 8.14.4/8.14.4; Thu, 5 Apr 2018 19:30:58 GMT</example>
1329
+ <param pos="0" name="service.product" value="Sendmail"/>
1330
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1331
+ <param pos="1" name="host.name"/>
1332
+ <param pos="2" name="service.version"/>
1333
+ <param pos="3" name="sendmail.config.version"/>
1334
+ <param pos="4" name="system.time"/>
1335
+ </fingerprint>
1336
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ ]+) ready at *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\))$">
1337
+ <description>Sendmail - with version and date (optional timezone), w/o config version</description>
1338
+ <example host.name="foo.bar" service.version="8.8.8" system.time="Tue, 6 Feb 2001 14:37:14 +0100">foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET)</example>
1339
+ <param pos="0" name="service.family" value="Sendmail"/>
1340
+ <param pos="0" name="service.product" value="Sendmail"/>
1341
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1342
+ <param pos="1" name="host.name"/>
1343
+ <param pos="2" name="service.version"/>
1344
+ <param pos="3" name="system.time"/>
1345
+ </fingerprint>
1346
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) - \([^\)]+\)/[^ ]+;? *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1347
+ <description>Sendmail - revision variant 1</description>
1348
+ <example>foo.foo.bar ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST)</example>
1349
+ <param pos="0" name="service.family" value="Sendmail"/>
1350
+ <param pos="0" name="service.product" value="Sendmail"/>
1351
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1352
+ <param pos="1" name="host.name"/>
1353
+ <param pos="2" name="service.version"/>
1354
+ <param pos="3" name="system.time"/>
1355
+ </fingerprint>
1356
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +(?:[^ ]+) +version +([^ ]+) +- +(?:[^;]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1357
+ <description>Sendmail - revision variant 2</description>
1358
+ <example>foo.foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT)</example>
1359
+ <param pos="0" name="service.family" value="Sendmail"/>
1360
+ <param pos="0" name="service.product" value="Sendmail"/>
1361
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1362
+ <param pos="1" name="host.name"/>
1363
+ <param pos="2" name="service.version"/>
1364
+ <param pos="3" name="system.time"/>
1365
+ </fingerprint>
1366
+ <fingerprint pattern="^(?i)([^ ]+) +(?:ESMTP +)?Sendmail *(?: Ready.? ?)?(?:;|at)? ?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1367
+ <description>Sendmail - with date, w/o version or platform, optional status string.</description>
1368
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ; Thu, 30 Nov 2017 17:50:14 +0900</example>
1369
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail; Thu, 30 Nov 2017 17:50:14 +0900</example>
1370
+ <example host.name="foo.bar" system.time="Wed, 20 May 2015 17:17:56 -0600">foo.bar ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1371
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 10:24:14 +0100">foo.bar ESMTP Sendmail Ready; Thu, 30 Nov 2017 10:24:14 +0100</example>
1372
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready at Fri, 6 Apr 2018 04:57:01 +0900</example>
1373
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready</example>
1374
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready. </example>
1375
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail</example>
1376
+ <example host.name="foo.bar">foo.bar Sendmail ready. </example>
1377
+ <param pos="0" name="service.family" value="Sendmail"/>
1378
+ <param pos="0" name="service.product" value="Sendmail"/>
1379
+ <param pos="1" name="host.name"/>
1380
+ <param pos="2" name="system.time"/>
1381
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1382
+ </fingerprint>
1383
+ <fingerprint pattern="^ESMTP Sendmail +([^/ ]+) */ *([^/ ]+); (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)$">
1384
+ <description>Sendmail - with version and date, w/o hostname or platform (semicolon variant)</description>
1385
+ <example service.version="8.13.1" sendmail.config.version="8.13.1" system.time="Thu, 30 Nov 2017 01:58:22 -0700">ESMTP Sendmail 8.13.1/8.13.1; Thu, 30 Nov 2017 01:58:22 -0700</example>
1386
+ <param pos="0" name="service.family" value="Sendmail"/>
1387
+ <param pos="0" name="service.product" value="Sendmail"/>
1388
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1389
+ <param pos="1" name="service.version"/>
1390
+ <param pos="2" name="sendmail.config.version"/>
1391
+ <param pos="3" name="system.time"/>
1392
+ </fingerprint>
1393
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) \([^\)]+\) *(.+) \(.+\)$">
1394
+ <description>Sendmail - unknown (date in version string variant)</description>
1395
+ <example>mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET)</example>
1396
+ <param pos="0" name="service.family" value="Sendmail"/>
1397
+ <param pos="0" name="service.product" value="Sendmail"/>
1398
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1399
+ <param pos="1" name="host.name"/>
1400
+ <param pos="2" name="service.version"/>
1401
+ <param pos="3" name="system.time"/>
1402
+ </fingerprint>
1403
+ <!-- *Sendmail* fingerprints after this line had NO matches in 2017.11.30 Project Sonar data set-->
1404
+ <fingerprint pattern="^([^ ]+) Sendmail ([^;]+); ([^;\.]+)$">
1405
+ <description>Sendmail - unknown platform, variant 1</description>
1406
+ <param pos="0" name="service.family" value="Sendmail"/>
1407
+ <param pos="0" name="service.product" value="Sendmail"/>
1408
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1409
+ <param pos="1" name="host.name"/>
1410
+ <param pos="2" name="service.version"/>
1411
+ <param pos="3" name="system.time"/>
1412
+ </fingerprint>
1413
+ <fingerprint pattern="^Sendmail ([^/]+)/([^/]+) ready on ([^ ]+)$">
1414
+ <description>Sendmail - basic with version and date</description>
1415
+ <param pos="0" name="service.family" value="Sendmail"/>
1416
+ <param pos="0" name="service.product" value="Sendmail"/>
1417
+ <param pos="1" name="service.version"/>
1418
+ <param pos="2" name="sendmail.config.version"/>
1419
+ <param pos="3" name="host.name"/>
1420
+ </fingerprint>
1421
+ <fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.(\d\.[\w.]+)\)$">
1422
+ <description>Sun Internet Mail Server</description>
1423
+ <example host.name="foo.bar" service.version="4.0.2000.10.12.16.25.p8">foo.bar -- Server ESMTP (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8)</example>
1424
+ <param pos="0" name="service.vendor" value="Sun"/>
1425
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
1426
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
1427
+ <param pos="0" name="os.vendor" value="Sun"/>
1428
+ <param pos="0" name="os.family" value="Solaris"/>
1429
+ <param pos="0" name="os.product" value="Solaris"/>
1430
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1431
+ <param pos="1" name="host.name"/>
1432
+ <param pos="2" name="service.version"/>
1433
+ </fingerprint>
1434
+ <fingerprint pattern="^(?:2.0.0 )?([^ ]+) ESMTP ecelerity (\d\.[\d.]+) r\(([^)]+)\) (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
1435
+ <description>Ecelerity</description>
1436
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:11:00 -0500">2.0.0 foo.bar ESMTP ecelerity 4.0.0.43760 r(Platform:4.0.0.1) Thu, 30 Nov 2017 05:11:00 -0500</example>
1437
+ <example>foo.bar ESMTP ecelerity 3.3.1.44388 r(44388) Thu, 30 Nov 2017 03:10:11 -0700</example>
1438
+ <example>foo.bar ESMTP ecelerity 3.6.25.56547 r(Core:3.6.25.0) Thu, 30 Nov 2017 03:17:07 -0600</example>
1439
+ <example service.version="4.2.37.61980" service.component.version=":">foo.bar ESMTP ecelerity 4.2.37.61980 r(:) Thu, 30 Nov 2017 09:58:54 +0000</example>
1440
+ <param pos="0" name="service.vendor" value="Ecelerity"/>
1441
+ <param pos="0" name="service.family" value="Ecelerity Mail Server"/>
1442
+ <param pos="0" name="service.product" value="Ecelerity Mail Server"/>
1443
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1444
+ <param pos="1" name="host.name"/>
1445
+ <param pos="2" name="service.version"/>
1446
+ <param pos="3" name="service.component.version"/>
1447
+ <param pos="4" name="system.time"/>
1448
+ </fingerprint>
1449
+ <fingerprint pattern="^(?i)([^ ]+) SMTP Server SLMail v?(\d\.[\d.]+) Ready ESMTP spoken here *$">
1450
+ <description>Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)</description>
1451
+ <example service.version="2.7">foo.bar Smtp Server SLMail v2.7 Ready ESMTP spoken here</example>
1452
+ <example service.version="3.2.3113">foo.bar SMTP Server SLmail 3.2.3113 Ready ESMTP spoken here</example>
1453
+ <example service.version="5.5.0.4433">foo.bar SMTP Server SLmail 5.5.0.4433 Ready ESMTP spoken here</example>
1454
+ <param pos="0" name="service.vendor" value="Seattle Labs"/>
1455
+ <param pos="0" name="service.family" value="SLMail"/>
1456
+ <param pos="0" name="service.product" value="SLMail"/>
1457
+ <param pos="1" name="host.name"/>
1458
+ <param pos="2" name="service.version"/>
1459
+ </fingerprint>
1460
+ <fingerprint pattern="^([^ ]+) +ESMTP Symantec Mail Security$">
1461
+ <description>Symantec Mail Security for SMTP</description>
1462
+ <example host.name="foo.bar">foo.bar ESMTP Symantec Mail Security</example>
1463
+ <param pos="0" name="service.vendor" value="Symantec"/>
1464
+ <param pos="0" name="service.product" value="Symantec Mail Security for SMTP"/>
1465
+ <param pos="1" name="host.name"/>
1466
+ </fingerprint>
1467
+ <fingerprint pattern="^([^ ]+) ESMTP Symantec Messaging Gateway$">
1468
+ <description>Symantec Mail Gateway</description>
1469
+ <example host.name="foo.bar">foo.bar ESMTP Symantec Messaging Gateway</example>
1470
+ <param pos="0" name="service.vendor" value="Symantec"/>
1471
+ <param pos="0" name="service.product" value="Symantec Messaging Gateway"/>
1472
+ <param pos="1" name="host.name"/>
1473
+ </fingerprint>
1474
+ <!-- SonicWall makes hardware, virtual appliances, and Windows software. The banner doesn't indicate which. -->
1475
+ <fingerprint pattern="^(?i)([^ ]+) ESMTP SonicWALL \(([\d.]+)\)$">
1476
+ <description>SonicWall Email Security</description>
1477
+ <example host.name="foo.bar" service.version="9.0.5.2077">foo.bar ESMTP SonicWALL (9.0.5.2077)</example>
1478
+ <example host.name="foo.bar" service.version="9.1.1.3113">foo.bar ESMTP SonicWall (9.1.1.3113)</example>
1479
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1480
+ <param pos="0" name="service.family" value="Email Security"/>
1481
+ <param pos="0" name="service.product" value="Email Security"/>
1482
+ <param pos="1" name="host.name"/>
1483
+ <param pos="2" name="service.version"/>
1484
+ </fingerprint>
1485
+ <fingerprint pattern="^([^ ]+) \(PowerMTA\(TM\) v([\d.r]+)\) ESMTP service ready$">
1486
+ <description>PowerMTA</description>
1487
+ <example host.name="foo.bar" service.version="3.2r24">foo.bar (PowerMTA(TM) v3.2r24) ESMTP service ready</example>
1488
+ <param pos="0" name="service.vendor" value="port25"/>
1489
+ <param pos="0" name="service.family" value="PowerMTA"/>
1490
+ <param pos="0" name="service.product" value="PowerMTA"/>
1491
+ <param pos="1" name="host.name"/>
1492
+ <param pos="2" name="service.version"/>
1493
+ </fingerprint>
1494
+ <fingerprint pattern="^([^ ]+) +VOPmail ESMTP Receiver Version (\d\.[\d.]+) Ready$">
1495
+ <description>VOPMail http://www.vircom.com/en/products/vopmail/vopmail.shtml</description>
1496
+ <example host.name="foo.bar" service.version="4.0.179.0">foo.bar VOPmail ESMTP Receiver Version 4.0.179.0 Ready</example>
1497
+ <param pos="0" name="service.vendor" value="Vircom"/>
1498
+ <param pos="0" name="service.family" value="VOPMail"/>
1499
+ <param pos="0" name="service.product" value="VOPMail"/>
1500
+ <param pos="1" name="host.name"/>
1501
+ <param pos="2" name="service.version"/>
1502
+ </fingerprint>
1503
+ <fingerprint pattern="^([^ ]+) VPOP3 E?SMTP Server (?:Ready|access not allowed!)$">
1504
+ <description>VPOP3 Email server: http://www.pscs.co.uk/products/vpop3/index.html</description>
1505
+ <example>foo.bar VPOP3 ESMTP Server Ready</example>
1506
+ <example>foo.bar VPOP3 SMTP Server Ready</example>
1507
+ <example>foo.bar VPOP3 SMTP Server access not allowed!</example>
1508
+ <param pos="0" name="service.vendor" value="Paul Smith Computer Services"/>
1509
+ <param pos="0" name="service.family" value="VPOP3"/>
1510
+ <param pos="0" name="service.product" value="VPOP3"/>
1511
+ <param pos="1" name="host.name"/>
1512
+ </fingerprint>
1513
+ <fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) (:?[^ ]+)? ?Network Associates.*Ready at (.+) *$">
1514
+ <description>McAfee WebShield</description>
1515
+ <example host.name="foo.bar" service.version="4.5" service.version.version="MR1a">foo.bar WebShield SMTP V4.5 MR1a Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1516
+ <example host.name="foo.bar" service.version="4.5" system.time="Thu Nov 30 09:15:32 2017">foo.bar WebShield SMTP V4.5 Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1517
+ <param pos="0" name="service.vendor" value="McAfee"/>
1518
+ <param pos="0" name="service.family" value="WebShield"/>
1519
+ <param pos="0" name="service.product" value="WebShield"/>
1520
+ <param pos="0" name="system.time.format" value="EEE d MMM HH:mm:ss yyyy"/>
1521
+ <param pos="1" name="host.name"/>
1522
+ <param pos="2" name="service.version"/>
1523
+ <param pos="3" name="service.version.version"/>
1524
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1525
+ <param pos="4" name="system.time"/>
1526
+ </fingerprint>
1527
+ <fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
1528
+ <description>McAfee Webshield ASaP (bundled hardware / software)</description>
1529
+ <example host.name="foo.bar" service.version="1.0.1" system.time="Sun, 29 Jul 2001 22:46:18 -0700">foo.bar McAfee WebShield ASaP v1.0.1: Sun, 29 Jul 2001 22:46:18 -0700</example>
1530
+ <param pos="0" name="service.vendor" value="McAfee"/>
1531
+ <param pos="0" name="service.family" value="WebShield"/>
1532
+ <param pos="0" name="service.product" value="WebShield"/>
1533
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1534
+ <param pos="0" name="os.vendor" value="McAfee"/>
1535
+ <param pos="0" name="os.family" value="Linux"/>
1536
+ <param pos="0" name="os.product" value="Linux"/>
1537
+ <param pos="1" name="host.name"/>
1538
+ <param pos="2" name="service.version"/>
1539
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1540
+ <param pos="3" name="system.time"/>
1541
+ </fingerprint>
1542
+ <fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
1543
+ <description>McAfee VirusScreen</description>
1544
+ <example host.name="foo.bar" service.version="1.1" system.time="Sun, 20 Jul 2003 09:20:52 -0700">foo.bar McAfee VirusScreen ASaP v1.1: Sun, 20 Jul 2003 09:20:52 -0700</example>
1545
+ <param pos="0" name="service.vendor" value="McAfee"/>
1546
+ <param pos="0" name="service.family" value="WebShield"/>
1547
+ <param pos="0" name="service.product" value="WebShield"/>
1548
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1549
+ <param pos="0" name="os.vendor" value="McAfee"/>
1550
+ <param pos="0" name="os.family" value="Linux"/>
1551
+ <param pos="0" name="os.product" value="Linux"/>
1552
+ <param pos="1" name="host.name"/>
1553
+ <param pos="2" name="service.version"/>
1554
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1555
+ <param pos="3" name="system.time"/>
1556
+ </fingerprint>
1557
+ <fingerprint pattern="^([^ ]+) ESMTP Lyris ListManager service ready$">
1558
+ <description>Lyris ListManager</description>
1559
+ <example host.name="foo.bar">foo.bar ESMTP Lyris ListManager service ready</example>
1560
+ <param pos="0" name="service.vendor" value="Lyris"/>
1561
+ <param pos="0" name="service.family" value="ListManager"/>
1562
+ <param pos="0" name="service.product" value="ListManager"/>
1563
+ <param pos="1" name="host.name"/>
1564
+ </fingerprint>
1565
+ <fingerprint pattern="^([^ ]+) ESMTP - WinRoute Pro ([^ ]+\.[^ ]+)$">
1566
+ <description>WinRoute Pro, runs on 9x/NT/2k http://www.tinysoftware.com/winpro.php</description>
1567
+ <example host.name="foo.bar" service.version="4.2.4">foo.bar ESMTP - WinRoute Pro 4.2.4</example>
1568
+ <param pos="0" name="service.family" value="WinRoute"/>
1569
+ <param pos="0" name="service.product" value="WinRoute"/>
1570
+ <param pos="1" name="host.name"/>
1571
+ <param pos="2" name="service.version"/>
1572
+ </fingerprint>
1573
+ <fingerprint pattern="^ESMTP - WinRoute Pro ([^ ]+\.[^ ]+) *(?: #\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)$">
1574
+ <description>WinRoute Pro w/o hostname</description>
1575
+ <example service.version="4.2.1">ESMTP - WinRoute Pro 4.2.1 Thu, 16 Nov 2017 11:48:15 +0300</example>
1576
+ <param pos="0" name="service.family" value="WinRoute"/>
1577
+ <param pos="0" name="service.product" value="WinRoute"/>
1578
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss Z"/>
1579
+ <param pos="1" name="service.version"/>
1580
+ <param pos="2" name="system.time"/>
1581
+ </fingerprint>
1582
+ <fingerprint pattern="^([^ ]+) ZMailer Server (\d\.[\d.]+) #([^ ]+) ESMTP ready at (.+) *$">
1583
+ <description>ZMailer http://www.zmailer.org/technical.html</description>
1584
+ <example service.version="2.99.57" service.version.version="1">foo.bar ZMailer Server 2.99.57 #1 ESMTP ready at Thu, 16 Nov 2017 12:00:12 +0300</example>
1585
+ <param pos="0" name="service.vendor" value="ZMailer"/>
1586
+ <param pos="0" name="service.family" value="ZMailer"/>
1587
+ <param pos="0" name="service.product" value="ZMailer"/>
1588
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1589
+ <param pos="1" name="host.name"/>
1590
+ <param pos="2" name="service.version"/>
1591
+ <param pos="3" name="service.version.version"/>
1592
+ <param pos="4" name="system.time"/>
1593
+ </fingerprint>
1594
+ <fingerprint pattern="^([^ ]+) ZMailer Server (\d\.[\d.]+) #([^ ]+) ESMTP\+IDENT ready at (.+) *$">
1595
+ <description>ZMailer server that supports IDENT</description>
1596
+ <example service.version="2.99.55" service.version.version="16">foo.bar ZMailer Server 2.99.55 #16 ESMTP+IDENT ready at Thu, 16 Nov 2017 06:51:42 -0300</example>
1597
+ <param pos="0" name="service.vendor" value="ZMailer"/>
1598
+ <param pos="0" name="service.family" value="ZMailer"/>
1599
+ <param pos="0" name="service.product" value="ZMailer"/>
1600
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1601
+ <param pos="0" name="zmailer.ident" value="yes"/>
1602
+ <param pos="1" name="host.name"/>
1603
+ <param pos="2" name="service.version"/>
1604
+ <param pos="3" name="service.version.version"/>
1605
+ <param pos="4" name="system.time"/>
1606
+ </fingerprint>
1607
+ <fingerprint pattern="^([^ ]+) Kerio Connect (\d\.[\d.]+) (?:patch (\d) )?ESMTP ready$">
1608
+ <description>Kerio Connect ESMTP</description>
1609
+ <example host.name="foo.bar" service.version="8.0.2">foo.bar Kerio Connect 8.0.2 ESMTP ready</example>
1610
+ <example service.version="9.2.5" service.version.version="3">foo.bar Kerio Connect 9.2.5 patch 3 ESMTP ready</example>
1611
+ <param pos="0" name="service.vendor" value="Kerio"/>
1612
+ <param pos="0" name="service.family" value="Connect"/>
1613
+ <param pos="0" name="service.product" value="ESMTP"/>
1614
+ <param pos="1" name="host.name"/>
1615
+ <param pos="2" name="service.version"/>
1616
+ <param pos="3" name="service.version.version"/>
1617
+ </fingerprint>
1618
+ <fingerprint pattern="^([^ ]+) ESMTP CommuniGate Pro (\d\.[\w.]+)(?:. It is you again :-\()?$">
1619
+ <description>Communigate Pro</description>
1620
+ <example host.name="foo.bar" service.version="5.3.1">foo.bar ESMTP CommuniGate Pro 5.3.1</example>
1621
+ <example host.name="foo.bar" service.version="6.2c3">foo.bar ESMTP CommuniGate Pro 6.2c3</example>
1622
+ <example host.name="foo.bar" service.version="4.3.12">foo.bar ESMTP CommuniGate Pro 4.3.12. It is you again :-(</example>
1623
+ <param pos="0" name="service.vendor" value="Communigater"/>
1624
+ <param pos="0" name="service.family" value="Pro"/>
1625
+ <param pos="0" name="service.product" value="ESMTP"/>
1626
+ <param pos="1" name="host.name"/>
1627
+ <param pos="2" name="service.version"/>
1628
+ </fingerprint>
1629
+ <fingerprint pattern="^(\S+) NO UCE NO UBE NO RELAY PROBES ESMTP">
1630
+ <description>Twisted SMTP server</description>
1631
+ <example host.name="foo.bar">foo.bar NO UCE NO UBE NO RELAY PROBES ESMTP</example>
1632
+ <param pos="0" name="service.vendor" value="Twisted Matrix Labs"/>
1633
+ <param pos="0" name="service.family" value="Twisted"/>
1634
+ <param pos="0" name="service.product" value="ESMTP"/>
1635
+ <param pos="1" name="host.name"/>
1636
+ </fingerprint>
1637
+ <fingerprint pattern="^Cellopoint E-mail Firewall v(\d\.[\d.]+) Build (\d+) ready$">
1638
+ <description>Cellopoint E-mail Firewall</description>
1639
+ <example service.version="3.9.12" service.version.version="0324">Cellopoint E-mail Firewall v3.9.12 Build 0324 ready</example>
1640
+ <param pos="0" name="service.vendor" value="Cellopoint"/>
1641
+ <param pos="0" name="service.family" value="UTM"/>
1642
+ <param pos="0" name="service.product" value="E-mail Firewall"/>
1643
+ <param pos="1" name="service.version"/>
1644
+ <param pos="2" name="service.version.version"/>
1645
+ </fingerprint>
1646
+ <fingerprint pattern="^ESMTP on WinWebMail \[(\d\.[\d.]+)\] ready\. http://www.winwebmail.com$">
1647
+ <description>Ma Jian WinWebMail</description>
1648
+ <example service.version="3.9.0.7">ESMTP on WinWebMail [3.9.0.7] ready. http://www.winwebmail.com</example>
1649
+ <param pos="0" name="service.vendor" value="Ma Jian"/>
1650
+ <param pos="0" name="service.family" value="WinWebMail"/>
1651
+ <param pos="0" name="service.product" value="ESMTP"/>
1652
+ <param pos="1" name="service.version"/>
1653
+ </fingerprint>
1654
+ <fingerprint pattern="^([^ ]+) Service ready by David.fx \((\d+)\) ESMTP Server \(Tobit.Software, Germany\)$">
1655
+ <description>Tobit Software David</description>
1656
+ <example service.version="0486">foo.bar Service ready by David.fx (0486) ESMTP Server (Tobit.Software, Germany)</example>
1657
+ <param pos="0" name="service.vendor" value="Tobit Software"/>
1658
+ <param pos="0" name="service.family" value="David"/>
1659
+ <param pos="0" name="service.product" value="ESMTP"/>
1660
+ <param pos="1" name="host.name"/>
1661
+ <param pos="2" name="service.version"/>
1662
+ </fingerprint>
1663
+ <fingerprint pattern="^(?i)(\S+) E?SMTP Perl">
1664
+ <description>Some simple PERL SMTP server</description>
1665
+ <example host.name="foo.bar">foo.bar ESMTP Perl</example>
1666
+ <param pos="0" name="service.product" value="Perl"/>
1667
+ <param pos="1" name="host.name"/>
1668
+ </fingerprint>
1669
+ <fingerprint pattern="^(?i)(?:([^ ]+) )?E?SMTP(?: (?:Service )?Ready\.?)?$">
1670
+ <description>Non-specific banner with optional hostname</description>
1671
+ <example host.name="foo.bar">foo.bar ESMTP</example>
1672
+ <example host.name="foo.bar">foo.bar ESMTP Ready</example>
1673
+ <example host.name="foo.bar">foo.bar SMTP</example>
1674
+ <example host.name="foo.bar">foo.bar ESMTP Service ready</example>
1675
+ <example>ESMTP ready</example>
1676
+ <example>SMTP Ready</example>
1677
+ <example>ESMTP READY</example>
1678
+ <param pos="1" name="host.name"/>
1679
+ </fingerprint>
1680
+ <fingerprint pattern="^([^ ]+) ESMTP OpenSMTPD$">
1681
+ <description>OpenSMPTD</description>
1682
+ <example host.name="foo.bar">foo.bar ESMTP OpenSMTPD</example>
1683
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1684
+ <param pos="0" name="service.family" value="OpenSMTPD"/>
1685
+ <param pos="0" name="service.product" value="OpenSMTPD"/>
1686
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:-"/>
1687
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:opensmtpd:-"/>
1688
+ <param pos="1" name="host.name"/>
1689
+ </fingerprint>
1690
+ </fingerprints>