recog-intrigue 2.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +7 -0
  2. data/.github/ISSUE_TEMPLATE/bug_report.md +37 -0
  3. data/.github/ISSUE_TEMPLATE/feature_request.md +17 -0
  4. data/.github/ISSUE_TEMPLATE/fingerprint_request.md +27 -0
  5. data/.github/PULL_REQUEST_TEMPLATE +24 -0
  6. data/.gitignore +14 -0
  7. data/.rbenv-gemset +1 -0
  8. data/.rspec +3 -0
  9. data/.ruby-gemset +1 -0
  10. data/.ruby-version +1 -0
  11. data/.travis.yml +25 -0
  12. data/.yardopts +1 -0
  13. data/CONTRIBUTING.md +171 -0
  14. data/COPYING +23 -0
  15. data/Gemfile +10 -0
  16. data/LICENSE +7 -0
  17. data/README.md +85 -0
  18. data/Rakefile +22 -0
  19. data/bin/recog_export +81 -0
  20. data/bin/recog_match +55 -0
  21. data/bin/recog_standardize +118 -0
  22. data/bin/recog_verify +64 -0
  23. data/cpe-remap.yaml +134 -0
  24. data/features/data/failing_banners_fingerprints.xml +20 -0
  25. data/features/data/matching_banners_fingerprints.xml +23 -0
  26. data/features/data/multiple_banners_fingerprints.xml +32 -0
  27. data/features/data/no_tests.xml +3 -0
  28. data/features/data/sample_banner.txt +2 -0
  29. data/features/data/successful_tests.xml +18 -0
  30. data/features/data/tests_with_failures.xml +20 -0
  31. data/features/data/tests_with_warnings.xml +17 -0
  32. data/features/match.feature +36 -0
  33. data/features/support/aruba.rb +3 -0
  34. data/features/support/env.rb +6 -0
  35. data/features/verify.feature +48 -0
  36. data/identifiers/README.md +47 -0
  37. data/identifiers/os_architecture.txt +20 -0
  38. data/identifiers/os_device.txt +52 -0
  39. data/identifiers/os_family.txt +160 -0
  40. data/identifiers/os_product.txt +199 -0
  41. data/identifiers/service_family.txt +185 -0
  42. data/identifiers/service_product.txt +255 -0
  43. data/identifiers/software_class.txt +26 -0
  44. data/identifiers/software_family.txt +91 -0
  45. data/identifiers/software_product.txt +333 -0
  46. data/identifiers/vendor.txt +405 -0
  47. data/lib/recog.rb +4 -0
  48. data/lib/recog/db.rb +78 -0
  49. data/lib/recog/db_manager.rb +31 -0
  50. data/lib/recog/fingerprint.rb +280 -0
  51. data/lib/recog/fingerprint/regexp_factory.rb +56 -0
  52. data/lib/recog/fingerprint/test.rb +18 -0
  53. data/lib/recog/formatter.rb +51 -0
  54. data/lib/recog/match_reporter.rb +77 -0
  55. data/lib/recog/matcher.rb +94 -0
  56. data/lib/recog/matcher_factory.rb +14 -0
  57. data/lib/recog/nizer.rb +347 -0
  58. data/lib/recog/verifier.rb +39 -0
  59. data/lib/recog/verifier_factory.rb +13 -0
  60. data/lib/recog/verify_reporter.rb +86 -0
  61. data/lib/recog/version.rb +3 -0
  62. data/misc/convert_mysql_err +61 -0
  63. data/misc/order.xsl +17 -0
  64. data/recog-intrigue.gemspec +45 -0
  65. data/requirements.txt +2 -0
  66. data/spec/data/best_os_match_1.yml +17 -0
  67. data/spec/data/best_os_match_2.yml +17 -0
  68. data/spec/data/best_service_match_1.yml +17 -0
  69. data/spec/data/smb_native_os.txt +25 -0
  70. data/spec/data/test_fingerprints.xml +36 -0
  71. data/spec/data/verification_fingerprints.xml +86 -0
  72. data/spec/data/whitespaced_fingerprint.xml +5 -0
  73. data/spec/lib/fingerprint_self_test_spec.rb +174 -0
  74. data/spec/lib/recog/db_spec.rb +98 -0
  75. data/spec/lib/recog/fingerprint/regexp_factory_spec.rb +73 -0
  76. data/spec/lib/recog/fingerprint_spec.rb +112 -0
  77. data/spec/lib/recog/formatter_spec.rb +69 -0
  78. data/spec/lib/recog/match_reporter_spec.rb +91 -0
  79. data/spec/lib/recog/nizer_spec.rb +330 -0
  80. data/spec/lib/recog/verify_reporter_spec.rb +113 -0
  81. data/spec/spec_helper.rb +82 -0
  82. data/update_cpes.py +186 -0
  83. data/xml/apache_modules.xml +1911 -0
  84. data/xml/apache_os.xml +273 -0
  85. data/xml/architecture.xml +36 -0
  86. data/xml/dns_versionbind.xml +761 -0
  87. data/xml/fingerprints.xsd +128 -0
  88. data/xml/ftp_banners.xml +1553 -0
  89. data/xml/h323_callresp.xml +603 -0
  90. data/xml/hp_pjl_id.xml +358 -0
  91. data/xml/html_title.xml +1630 -0
  92. data/xml/http_cookies.xml +411 -0
  93. data/xml/http_servers.xml +3195 -0
  94. data/xml/http_wwwauth.xml +595 -0
  95. data/xml/imap_banners.xml +245 -0
  96. data/xml/ldap_searchresult.xml +711 -0
  97. data/xml/mdns_device-info_txt.xml +1796 -0
  98. data/xml/mdns_workstation_txt.xml +15 -0
  99. data/xml/mysql_banners.xml +1649 -0
  100. data/xml/mysql_error.xml +871 -0
  101. data/xml/nntp_banners.xml +82 -0
  102. data/xml/ntp_banners.xml +1223 -0
  103. data/xml/operating_system.xml +629 -0
  104. data/xml/pop_banners.xml +499 -0
  105. data/xml/rsh_resp.xml +76 -0
  106. data/xml/rtsp_servers.xml +76 -0
  107. data/xml/sip_banners.xml +359 -0
  108. data/xml/sip_user_agents.xml +221 -0
  109. data/xml/smb_native_lm.xml +62 -0
  110. data/xml/smb_native_os.xml +662 -0
  111. data/xml/smtp_banners.xml +1690 -0
  112. data/xml/smtp_debug.xml +39 -0
  113. data/xml/smtp_ehlo.xml +49 -0
  114. data/xml/smtp_expn.xml +82 -0
  115. data/xml/smtp_help.xml +157 -0
  116. data/xml/smtp_mailfrom.xml +20 -0
  117. data/xml/smtp_noop.xml +44 -0
  118. data/xml/smtp_quit.xml +29 -0
  119. data/xml/smtp_rcptto.xml +25 -0
  120. data/xml/smtp_rset.xml +26 -0
  121. data/xml/smtp_turn.xml +26 -0
  122. data/xml/smtp_vrfy.xml +89 -0
  123. data/xml/snmp_sysdescr.xml +6507 -0
  124. data/xml/snmp_sysobjid.xml +430 -0
  125. data/xml/ssh_banners.xml +1968 -0
  126. data/xml/telnet_banners.xml +1595 -0
  127. data/xml/x11_banners.xml +232 -0
  128. data/xml/x509_issuers.xml +134 -0
  129. data/xml/x509_subjects.xml +1268 -0
  130. metadata +304 -0
data/xml/smtp_banners.xml ADDED
@@ -0,0 +1,1690 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
3
+ <!--
4
+ SMTP greeting lines (part of the banner after the response code) are matched
5
+ against these patterns (1 line at a time) to fingerprint SMTP servers.
6
+
7
+ This is always done in addition to the patterns in other smtp_*.xml files.
8
+ These XML files are used in this order:
9
+ smtp_banners.xml
10
+ smtp_ehlo.xml
11
+ smtp_help.xml
12
+ smtp_noop.xml
13
+ smtp_expn.xml
14
+ smtp_vrfy.xml
15
+ smtp_debug.xml
16
+ smtp_turn.xml
17
+ smtp_rset.xml
18
+ smtp_quit.xml
19
+
20
+ The system or service fingerprint with the highest certainty overwrites the others.
21
+
22
+ 'preference' notes: This value has been impacted by the poor quality of the 'Cisco PIX' match.
23
+ Additionally, the 'preference' value for the other databases mentioned above has been set so
24
+ as to implement their preference as described.
25
+ -->
26
+ <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
27
+ <description>IMail - EVAL version</description>
28
+ <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 EVAL 11347-1)</example>
29
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
30
+ <param pos="0" name="service.family" value="IMail Server"/>
31
+ <param pos="0" name="service.product" value="IMail Server"/>
32
+ <param pos="2" name="service.version"/>
33
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
34
+ <param pos="1" name="host.name"/>
35
+ <param pos="0" name="imail.eval" value="yes"/>
36
+ </fingerprint>
37
+ <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\)$">
38
+ <description>IMail - non-EVAL version</description>
39
+ <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 899085-1)</example>
40
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
41
+ <param pos="0" name="service.family" value="IMail Server"/>
42
+ <param pos="0" name="service.product" value="IMail Server"/>
43
+ <param pos="2" name="service.version"/>
44
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
45
+ <param pos="1" name="host.name"/>
46
+ </fingerprint>
47
+ <fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
48
+ <description>IMail - non-EVAL version, NT-ESMTP at end</description>
49
+ <example service.version="12.4.2.27">foo.bar (IMail 12.4.2.27 21349-1) NT-ESMTP Server X1</example>
50
+ <param pos="0" name="service.vendor" value="Ipswitch"/>
51
+ <param pos="0" name="service.family" value="IMail Server"/>
52
+ <param pos="0" name="service.product" value="IMail Server"/>
53
+ <param pos="2" name="service.version"/>
54
+ <param pos="0" name="service.cpe23" value="cpe:/a:ipswitch:imail_server:{service.version}"/>
55
+ <param pos="1" name="host.name"/>
56
+ </fingerprint>
57
+ <fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
58
+ <description>AnalogX proxy (http://www.analogx.com/contents/download/network/proxy.htm)</description>
59
+ <example host.name="192.168.1.1" service.version="4.15">192.168.1.1 SMTP AnalogX Proxy 4.15 (Release) ready</example>
60
+ <param pos="0" name="service.vendor" value="AnalogX"/>
61
+ <param pos="0" name="service.family" value="Proxy"/>
62
+ <param pos="0" name="service.product" value="Proxy"/>
63
+ <param pos="2" name="service.version"/>
64
+ <param pos="0" name="service.cpe23" value="cpe:/a:analogx:proxy:{service.version}"/>
65
+ <param pos="1" name="host.name"/>
66
+ </fingerprint>
67
+ <fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
68
+ <description>ArGoSoft Mail Server</description>
69
+ <example service.version="1.4.0.7">ArGoSoft Mail Server, Version 1.4 (1.4.0.7)</example>
70
+ <param pos="0" name="os.vendor" value="Microsoft"/>
71
+ <param pos="0" name="os.family" value="Windows"/>
72
+ <param pos="0" name="os.product" value="Windows"/>
73
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
74
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
75
+ <param pos="0" name="service.family" value="Mail Server"/>
76
+ <param pos="0" name="service.product" value="Mail Server"/>
77
+ <param pos="1" name="service.version"/>
78
+ </fingerprint>
79
+ <fingerprint pattern="^^(?:(\S+) +)?ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
80
+ <description>ArGoSoft Mail Server - freeware version</description>
81
+ <example host.name="foo.bar" service.version="1.8.8.8">foo.bar ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
82
+ <example service.version="1.8.8.8">ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
83
+ <param pos="0" name="os.vendor" value="Microsoft"/>
84
+ <param pos="0" name="os.family" value="Windows"/>
85
+ <param pos="0" name="os.product" value="Windows"/>
86
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
87
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
88
+ <param pos="0" name="service.family" value="Mail Server"/>
89
+ <param pos="0" name="service.product" value="Mail Server"/>
90
+ <param pos="2" name="service.version"/>
91
+ <param pos="1" name="host.name"/>
92
+ </fingerprint>
93
+ <fingerprint pattern="^(?:(\S+) +)?ArGoSoft Mail Server Pro for WinNT\/2000(?:\/XP)?, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
94
+ <description>ArGoSoft Mail Server - Pro version</description>
95
+ <example service.version="1.6.1.8">ArGoSoft Mail Server Pro for WinNT/2000, Version 1.61 (1.6.1.8)</example>
96
+ <example service.version="1.8.9.5">ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
97
+ <example host.name="foo.bar" service.version="1.8.9.5">foo.bar ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
98
+ <param pos="0" name="os.vendor" value="Microsoft"/>
99
+ <param pos="0" name="os.family" value="Windows"/>
100
+ <param pos="0" name="os.product" value="Windows"/>
101
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
102
+ <param pos="0" name="service.vendor" value="ArGoSoft"/>
103
+ <param pos="0" name="service.family" value="Mail Server"/>
104
+ <param pos="0" name="service.product" value="Mail Server"/>
105
+ <param pos="1" name="host.name"/>
106
+ <param pos="2" name="service.version"/>
107
+ </fingerprint>
108
+ <fingerprint pattern="^([^ ]+) +AppleShare IP Mail Server ([^ ]+\.[\d.]+) SMTP Server Ready *$">
109
+ <description>AppleShare IP Mail Server</description>
110
+ <example service.version="6.2.1">foo.bar AppleShare IP Mail Server 6.2.1 SMTP Server Ready</example>
111
+ <example service.version="6.2">foo.bar AppleShare IP Mail Server 6.2 SMTP Server Ready</example>
112
+ <param pos="0" name="service.vendor" value="Apple"/>
113
+ <param pos="0" name="service.family" value="AppleShare IP Mail Server"/>
114
+ <param pos="0" name="service.product" value="AppleShare IP Mail Server"/>
115
+ <param pos="1" name="host.name"/>
116
+ <param pos="2" name="service.version"/>
117
+ </fingerprint>
118
+ <fingerprint pattern="^CheckPoint FireWall-1 secure E?SMTP server *$">
119
+ <description>CheckPoint FireWall-1</description>
120
+ <example>CheckPoint FireWall-1 secure SMTP server</example>
121
+ <example>CheckPoint FireWall-1 secure ESMTP server</example>
122
+ <param pos="0" name="service.vendor" value="Check Point"/>
123
+ <param pos="0" name="service.family" value="Check Point"/>
124
+ <param pos="0" name="service.product" value="Firewall-1"/>
125
+ <param pos="0" name="service.cpe23" value="cpe:/a:checkpoint:firewall-1:-"/>
126
+ </fingerprint>
127
+ <fingerprint pattern="^SMTP/cmap ready_+$">
128
+ <description>Cisco Pix v4.x</description>
129
+ <example>SMTP/cmap ready________________________________________________________________________</example>
130
+ <param pos="0" name="os.vendor" value="Cisco"/>
131
+ <param pos="0" name="os.family" value="PIX"/>
132
+ <param pos="0" name="os.product" value="PIX"/>
133
+ <param pos="0" name="os.version" value="4"/>
134
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:4"/>
135
+ </fingerprint>
136
+ <fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
137
+ <description>Youngzsoft CCProxy SMTP</description>
138
+ <example service.version="7.3">CCProxy 7.3 SMTP Service Ready(Unregistered)</example>
139
+ <param pos="0" name="service.vendor" value="Youngzsoft"/>
140
+ <param pos="0" name="service.family" value="CCProxy"/>
141
+ <param pos="0" name="service.product" value="CCProxy"/>
142
+ <param pos="1" name="service.version"/>
143
+ </fingerprint>
144
+ <!--
145
+ Cisco PIX sits between an internal SMTP server and the rest of the world.
146
+
147
+ Its MailGuard feature strips all information out of the 220 header except for the ' ' (space), '2' (digit two),
148
+ and '0' (digit zero) characters, replacing them with asterisks. While this effectively
149
+ hides the back-end SMTP server, it does tell us that they are running Cisco PIX firewall
150
+ (at least for SMTP, and possibly other services as well).
151
+
152
+ Search Cisco's documentation for "fixup protocol SMTP" for more information.
153
+ -->
154
+ <fingerprint pattern="^[\*20 ]+$">
155
+ <description>Cisco PIX firewall MailGuard banner stripping</description>
156
+ <example os.product="PIX">***************************</example>
157
+ <param pos="0" name="os.vendor" value="Cisco"/>
158
+ <param pos="0" name="os.family" value="PIX"/>
159
+ <param pos="0" name="os.product" value="PIX"/>
160
+ <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
161
+ </fingerprint>
162
+ <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
163
+ <description>Critical Path (aka InScribe) Messaging Server on Windows NT4/2k, Solaris 2.6/2.7/2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, or AIX </description>
164
+ <param pos="0" name="service.vendor" value="Critical Path"/>
165
+ <param pos="0" name="service.family" value="Messaging Server"/>
166
+ <param pos="0" name="service.product" value="Messaging Server"/>
167
+ <param pos="1" name="host.name"/>
168
+ <param pos="2" name="service.version"/>
169
+ <param pos="3" name="service.version.version"/>
170
+ <param pos="4" name="service.version.version.version"/>
171
+ <param pos="5" name="service.version.version.version.version"/>
172
+ </fingerprint>
173
+ <fingerprint pattern="^CSM Internet Mail Scanner SMTP-Gateway ready?\. *$">
174
+ <description>CSM Internet Mail Scanner SMTP Proxy</description>
175
+ <example>CSM Internet Mail Scanner SMTP-Gateway ready.</example>
176
+ <example>CSM Internet Mail Scanner SMTP-Gateway read.</example>
177
+ <param pos="0" name="service.vendor" value="CSM"/>
178
+ <param pos="0" name="service.family" value="Internet Mail Scanner"/>
179
+ <param pos="0" name="service.product" value="Internet Mail Scanner"/>
180
+ </fingerprint>
181
+ <fingerprint pattern="^([^ ]+) +IMS SMTP Receiver Version ([^ ]+\.[^ ]+) Ready *$">
182
+ <description>EMWAC Internet Mail Services (http://emwac.ed.ac.uk/html/internet_toolchest/ims/ims.htm)</description>
183
+ <example service.version="0.83" host.name="foo.bar">foo.bar IMS SMTP Receiver Version 0.83 Ready</example>
184
+ <param pos="0" name="service.vendor" value="EMWAC"/>
185
+ <param pos="0" name="service.family" value="Internet Mail Services"/>
186
+ <param pos="0" name="service.product" value="Internet Mail Services"/>
187
+ <param pos="1" name="host.name"/>
188
+ <param pos="2" name="service.version"/>
189
+ </fingerprint>
190
+ <fingerprint pattern="^([^ ]+) running Eudora Internet Mail Server (\d\.[\d.]+) *$">
191
+ <description>Eudora Internet Mail Server</description>
192
+ <example service.version="3.0.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 3.0.2</example>
193
+ <example service.version="2.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 2.2</example>
194
+ <param pos="0" name="service.vendor" value="Eudora"/>
195
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
196
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
197
+ <param pos="0" name="os.vendor" value="Apple"/>
198
+ <param pos="0" name="os.family" value="Mac OS"/>
199
+ <param pos="0" name="os.product" value="Mac OS"/>
200
+ <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os:-"/>
201
+ <param pos="1" name="host.name"/>
202
+ <param pos="2" name="service.version"/>
203
+ </fingerprint>
204
+ <fingerprint pattern="^([^ ]+) +ESMTP Server \(Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+)\) ready *$">
205
+ <description>Microsoft Exchange Server 5.5 and above (for sure, can't be confused with the IIS builtin SMTP service)</description>
206
+ <example host.name="foo.bar" service.version="5.5.2653.13">foo.bar ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready</example>
207
+ <param pos="0" name="service.vendor" value="Microsoft"/>
208
+ <param pos="0" name="service.family" value="Exchange Server"/>
209
+ <param pos="0" name="service.product" value="Exchange Server"/>
210
+ <param pos="2" name="service.version"/>
211
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
212
+ <param pos="1" name="host.name"/>
213
+ <param pos="0" name="os.vendor" value="Microsoft"/>
214
+ <param pos="0" name="os.family" value="Windows"/>
215
+ <param pos="0" name="os.product" value="Windows"/>
216
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
217
+ </fingerprint>
218
+ <fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
219
+ <description>Microsoft Exchange Server 5.0 (for sure, can't be confused with the IIS builtin SMTP service)</description>
220
+ <example host.name="foo.bar" service.version="5.0.1460.8">foo.bar Microsoft Exchange Internet Mail Service 5.0.1460.8 ready</example>
221
+ <param pos="0" name="service.vendor" value="Microsoft"/>
222
+ <param pos="0" name="service.family" value="Exchange Server"/>
223
+ <param pos="0" name="service.product" value="Exchange Server"/>
224
+ <param pos="2" name="service.version"/>
225
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:{service.version}"/>
226
+ <param pos="1" name="host.name"/>
227
+ <param pos="0" name="os.vendor" value="Microsoft"/>
228
+ <param pos="0" name="os.family" value="Windows"/>
229
+ <param pos="0" name="os.product" value="Windows"/>
230
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
231
+ </fingerprint>
232
+ <fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
233
+ <description>Microsoft Exchange 2007/2010 (for sure, can't be confused with the IIS builtin SMTP service)</description>
234
+ <example>foo.bar Microsoft ESMTP MAIL Service ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
235
+ <param pos="0" name="service.vendor" value="Microsoft"/>
236
+ <param pos="0" name="service.family" value="Exchange Server"/>
237
+ <param pos="0" name="service.product" value="Exchange Server"/>
238
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:exchange_server:-"/>
239
+ <param pos="1" name="host.name"/>
240
+ <param pos="0" name="os.vendor" value="Microsoft"/>
241
+ <param pos="0" name="os.family" value="Windows"/>
242
+ <param pos="0" name="os.product" value="Windows"/>
243
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
244
+ </fingerprint>
245
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(10\.0\.14393\.[\d.]+) +ready +(?:at +)?(.+)$">
246
+ <description>Microsoft IIS builtin SMTP service - Windows Server 2016</description>
247
+ <example host.name="foo.bar" service.version="10.0.14393.2608">foo.bar Microsoft ESMTP MAIL Service, Version: 10.0.14393.2608 ready at Sun, 19 May 2019 09:04:29 -0500</example>
248
+ <param pos="0" name="service.vendor" value="Microsoft"/>
249
+ <param pos="0" name="service.family" value="IIS"/>
250
+ <param pos="0" name="service.product" value="IIS"/>
251
+ <param pos="2" name="service.version"/>
252
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:10.0"/>
253
+ <param pos="1" name="host.name"/>
254
+ <param pos="3" name="system.time"/>
255
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
256
+ <param pos="0" name="os.vendor" value="Microsoft"/>
257
+ <param pos="0" name="os.family" value="Windows"/>
258
+ <param pos="0" name="os.product" value="Windows Server 2016"/>
259
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2016:-"/>
260
+ </fingerprint>
261
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(10\.0\.17763\.[\d.]+) +ready +(?:at +)?(.+)$">
262
+ <description>Microsoft IIS builtin SMTP service - Windows Server 2019</description>
263
+ <example host.name="foo.bar" service.version="10.0.17763.1">foo.bar Microsoft ESMTP MAIL Service, Version: 10.0.17763.1 ready at Sun, 19 May 2019 09:04:29 -0500</example>
264
+ <param pos="0" name="service.vendor" value="Microsoft"/>
265
+ <param pos="0" name="service.family" value="IIS"/>
266
+ <param pos="0" name="service.product" value="IIS"/>
267
+ <param pos="2" name="service.version"/>
268
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:10.0"/>
269
+ <param pos="1" name="host.name"/>
270
+ <param pos="3" name="system.time"/>
271
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
272
+ <param pos="0" name="os.vendor" value="Microsoft"/>
273
+ <param pos="0" name="os.family" value="Windows"/>
274
+ <param pos="0" name="os.product" value="Windows Server 2019"/>
275
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2019:-"/>
276
+ </fingerprint>
277
+ <fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
278
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 1</description>
279
+ <example host.name="foo.bar" service.version="5.5.1877.197.19">foo.bar Microsoft SMTP MAIL ready at Wed, 29 Nov 2017 23:48:59 +0000 Version: 5.5.1877.197.19</example>
280
+ <param pos="0" name="service.vendor" value="Microsoft"/>
281
+ <param pos="0" name="service.family" value="IIS"/>
282
+ <param pos="0" name="service.product" value="IIS"/>
283
+ <param pos="3" name="service.version"/>
284
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
285
+ <param pos="1" name="host.name"/>
286
+ <param pos="2" name="system.time"/>
287
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
288
+ <param pos="0" name="os.vendor" value="Microsoft"/>
289
+ <param pos="0" name="os.family" value="Windows"/>
290
+ <param pos="0" name="os.product" value="Windows"/>
291
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
292
+ </fingerprint>
293
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+)(?: +ready)?(?: +(?:at +)?(\w\w\w, \d.+))?$">
294
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 2 </description>
295
+ <example service.version="5.0.2195.5329"> Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready Thu, 30 Nov 2017 11:40:25 +0200</example>
296
+ <example service.version="6.0.3790.4675" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
297
+ <example service.version="6.0.2600.5512" system.time="Thu, 30 Nov 2017 18:22:40 +0900">Microsoft ESMTP MAIL Service, Version: 6.0.2600.5512 ready at Thu, 30 Nov 2017 18:22:40 +0900</example>
298
+ <example service.version="6.0.3790.3959" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready</example>
299
+ <example service.version="6.0.3790.1830" host.name="foo.bar">foo.bar Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830</example>
300
+ <param pos="0" name="service.vendor" value="Microsoft"/>
301
+ <param pos="0" name="service.family" value="IIS"/>
302
+ <param pos="0" name="service.product" value="IIS"/>
303
+ <param pos="2" name="service.version"/>
304
+ <param pos="0" name="service.cpe23" value="cpe:/a:microsoft:iis:{service.version}"/>
305
+ <param pos="1" name="host.name"/>
306
+ <param pos="3" name="system.time"/>
307
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
308
+ <param pos="0" name="os.vendor" value="Microsoft"/>
309
+ <param pos="0" name="os.family" value="Windows"/>
310
+ <param pos="0" name="os.product" value="Windows"/>
311
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
312
+ </fingerprint>
313
+ <fingerprint pattern="^ESMTP Exim$">
314
+ <description>Exim - without version string or hostname</description>
315
+ <example>ESMTP Exim</example>
316
+ <param pos="0" name="service.vendor" value="exim"/>
317
+ <param pos="0" name="service.family" value="exim"/>
318
+ <param pos="0" name="service.product" value="exim"/>
319
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
320
+ </fingerprint>
321
+ <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
322
+ <description>Exim - with version string and optional timestamp</description>
323
+ <example service.version="4.89" host.name="foo.bar">foo.bar ESMTP Exim 4.89 "</example>
324
+ <example service.version="4.83" host.name="foo.bar">foo.bar, ESMTP EXIM 4.83</example>
325
+ <example service.version="4.84_2" host.name="foo.bar">foo.bar ESMTP Exim 4.84_2 </example>
326
+ <example service.version="4.90_RC3" host.name="foo.bar">foo.bar ESMTP Exim 4.90_RC3 Thu, 30 Nov 2017 03:52:16 -0700 </example>
327
+ <example service.version="4.89_1b" host.name="foo.bar">foo.bar ESMTP Exim 4.89_1b Thu, 05 Apr 2018 21:30:37 +0200</example>
328
+ <example service.version="4.89-122312">foo.bar ESMTP Exim 4.89-122312 Thu, 16 Nov 2017 10:33:38 +0200 </example>
329
+ <example service.version="4.87">foo.bar ESMTP (Exim 4.87) Thu, 30 Nov 2017 03:25:58 -0800 </example>
330
+ <example service.version="4.80" system.time="Thu, 16 Nov 2017 01:04:30 -0800">foo.bar ESMTP Exim 4.80 Thu, 16 Nov 2017 01:04:30 -0800 </example>
331
+ <example service.version="3.12" system.time="Wed, 31 Jan 2001 15:47:23 +1100">foo.bar ESMTP Exim 3.12 #1 Wed, 31 Jan 2001 15:47:23 +1100 </example>
332
+ <example service.version="4.89" host.name="foo.bar"> foo.bar ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 04:55:31 -0500 We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.</example>
333
+ <param pos="0" name="service.vendor" value="exim"/>
334
+ <param pos="0" name="service.family" value="exim"/>
335
+ <param pos="0" name="service.product" value="exim"/>
336
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
337
+ <param pos="1" name="host.name"/>
338
+ <param pos="2" name="service.version"/>
339
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
340
+ <param pos="3" name="system.time"/>
341
+ </fingerprint>
342
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
343
+ <description>Exim - with digit only version string and optional timestamp</description>
344
+ <example service.version="125302" host.name="foo.bar">foo.bar ESMTP Exim 125302 Thu, 16 Nov 2017 04:55:11 -0500 </example>
345
+ <param pos="0" name="service.vendor" value="exim"/>
346
+ <param pos="0" name="service.family" value="exim"/>
347
+ <param pos="0" name="service.product" value="exim"/>
348
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
349
+ <param pos="1" name="host.name"/>
350
+ <param pos="2" name="service.version"/>
351
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
352
+ <param pos="3" name="system.time"/>
353
+ </fingerprint>
354
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
355
+ <description>Exim - with version string and optional timestamp (Ubuntu)</description>
356
+ <example service.version="4.82" system.time="Thu, 16 Nov 2017 11:30:44 +0300">foo.bar ESMTP Exim 4.82 Ubuntu Thu, 16 Nov 2017 11:30:44 +0300 </example>
357
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
358
+ <param pos="0" name="os.family" value="Linux"/>
359
+ <param pos="0" name="os.product" value="Linux"/>
360
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
361
+ <param pos="0" name="service.vendor" value="exim"/>
362
+ <param pos="0" name="service.family" value="exim"/>
363
+ <param pos="0" name="service.product" value="exim"/>
364
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
365
+ <param pos="1" name="host.name"/>
366
+ <param pos="2" name="service.version"/>
367
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
368
+ <param pos="3" name="system.time"/>
369
+ </fingerprint>
370
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
371
+ <description>Exim - without version string and with optional timestamp</description>
372
+ <example host.name="foo.bar">foo.bar ESMTP Exim</example>
373
+ <example host.name="foo.bar" system.time="Thu, 16 Nov 2017 01:11:30 -0800">foo.bar ESMTP Exim Thu, 16 Nov 2017 01:11:30 -0800 </example>
374
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:31:32 -0500">foo.bar ESMTP Exim #1 Thu, 30 Nov 2017 05:31:32 -0500 </example>
375
+ <param pos="0" name="service.vendor" value="exim"/>
376
+ <param pos="0" name="service.family" value="exim"/>
377
+ <param pos="0" name="service.product" value="exim"/>
378
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
379
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
380
+ <param pos="1" name="host.name"/>
381
+ <param pos="2" name="system.time"/>
382
+ </fingerprint>
383
+ <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
384
+ <description>Exim - without hostname</description>
385
+ <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
386
+ <example service.version="4.82"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
387
+ <example service.version="4.89"> ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 07:32:28 -0200 </example>
388
+ <param pos="0" name="service.vendor" value="exim"/>
389
+ <param pos="0" name="service.family" value="exim"/>
390
+ <param pos="0" name="service.product" value="exim"/>
391
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
392
+ <param pos="1" name="service.version"/>
393
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:{service.version}"/>
394
+ <param pos="2" name="system.time"/>
395
+ </fingerprint>
396
+ <fingerprint pattern="^ ?([^, ]+) Exim ESMTP Service ready$">
397
+ <description>Exim - with hostname </description>
398
+ <example host.name="foo.bar">foo.bar Exim ESMTP Service ready</example>
399
+ <param pos="0" name="service.vendor" value="exim"/>
400
+ <param pos="0" name="service.family" value="exim"/>
401
+ <param pos="0" name="service.product" value="exim"/>
402
+ <param pos="1" name="host.name"/>
403
+ <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
404
+ </fingerprint>
405
+ <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
406
+ <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
407
+ <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
408
+ <param pos="0" name="service.vendor" value="Floosietek"/>
409
+ <param pos="0" name="service.family" value="FTGate"/>
410
+ <param pos="0" name="service.product" value="FTGate"/>
411
+ <param pos="1" name="host.name"/>
412
+ </fingerprint>
413
+ <fingerprint pattern="^([^ ]+) +SMTP/smap Ready\.$">
414
+ <description>TIS FWTK and derivatives (other firewalls, like Gauntlet, are derived from TIS)</description>
415
+ <example host.name="foo.bar">foo.bar SMTP/smap Ready.</example>
416
+ <param pos="0" name="service.vendor" value="TIS"/>
417
+ <param pos="0" name="service.family" value="FWTK"/>
418
+ <param pos="0" name="service.product" value="FWTK"/>
419
+ <param pos="1" name="host.name"/>
420
+ </fingerprint>
421
+ <fingerprint pattern="^([^ ]+) GroupWise Internet Agent ([^ ]+\.[^ ]+\.[^ ]+) Ready \(C\).* Novell, Inc\. *$">
422
+ <description>Novell GroupWise Internet Agent - versions 5 and higher</description>
423
+ <example service.version="5.5.1">foo.bar GroupWise Internet Agent 5.5.1 Ready (C)1993, 1998 Novell, Inc.</example>
424
+ <param pos="0" name="service.vendor" value="Novell"/>
425
+ <param pos="0" name="service.family" value="GroupWise"/>
426
+ <param pos="0" name="service.product" value="GroupWise"/>
427
+ <param pos="1" name="host.name"/>
428
+ <param pos="2" name="service.version"/>
429
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
430
+ </fingerprint>
431
+ <fingerprint pattern="^([^ ]+) GroupWise Internet Agent (\d+\.[\d.]+) Copyright .*\d{4}-\d{4} Novell, Inc..* All rights reserved. Ready *$">
432
+ <description>Novell GroupWise Internet Agent - versions 5 and higher, second variant</description>
433
+ <example service.version="8.0.3">foo.bar GroupWise Internet Agent 8.0.3 Copyright (c) 1993-2012 Novell, Inc. All rights reserved. Ready</example>
434
+ <example service.version="14.2.1">foo.bar GroupWise Internet Agent 14.2.1 Copyright 1993-2016 Novell, Inc., a Micro Focus Company. All rights reserved. Ready</example>
435
+ <param pos="0" name="service.vendor" value="Novell"/>
436
+ <param pos="0" name="service.family" value="GroupWise"/>
437
+ <param pos="0" name="service.product" value="GroupWise"/>
438
+ <param pos="1" name="host.name"/>
439
+ <param pos="2" name="service.version"/>
440
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
441
+ </fingerprint>
442
+ <fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
443
+ <description>Novell GroupWise - versions below 5</description>
444
+ <example host.name="foo.bar" service.version="4.1" service.version.version="3">foo.bar GroupWise SMTP/MIME Daemon 4.1 v3 Ready (C)1993, 1996 Novell, Inc.</example>
445
+ <param pos="0" name="service.vendor" value="Novell"/>
446
+ <param pos="0" name="service.family" value="GroupWise"/>
447
+ <param pos="0" name="service.product" value="GroupWise"/>
448
+ <param pos="1" name="host.name"/>
449
+ <param pos="2" name="service.version"/>
450
+ <param pos="3" name="service.version.version"/>
451
+ <param pos="0" name="service.cpe23" value="cpe:/a:novell:groupwise:{service.version}"/>
452
+ </fingerprint>
453
+ <fingerprint pattern="^([^ ]+) (?:ESMTP )?running IBM VM SMTP (.+)(?:; | on )(.+) *$">
454
+ <description>IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.</description>
455
+ <example service.version="Level 640" system.time="Thu, 30 Nov 2017 01:08:59 PDT">foo.bar running IBM VM SMTP Level 640 on Thu, 30 Nov 2017 01:08:59 PDT</example>
456
+ <example service.version="Level 3A0">foo.bar running IBM VM SMTP Level 3A0 on Mon, 10 Sep 2001 07:21:54 EDT</example>
457
+ <example service.version="V2R4" system.time="Mon, 10 Sep 2001 07:24:35 -0400 (EDT)">foo.bar ESMTP running IBM VM SMTP V2R4; Mon, 10 Sep 2001 07:24:35 -0400 (EDT)</example>
458
+ <param pos="0" name="service.vendor" value="IBM"/>
459
+ <param pos="0" name="service.family" value="VM"/>
460
+ <param pos="0" name="service.product" value="VM"/>
461
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
462
+ <param pos="1" name="host.name"/>
463
+ <param pos="2" name="service.version"/>
464
+ <param pos="3" name="system.time"/>
465
+ </fingerprint>
466
+ <fingerprint pattern="^([^ ]+) \(IntraStore TurboSendmail\) ESMTP Service ready *$">
467
+ <description>
468
+ Syntegra/CDC IntraStore TurboSendmail, part of the IntraStore server which runs on
469
+ the following platforms ONLY: Linux, HP-UX, Solaris, AIX, and Windows NT/2000
470
+ see http://www.cdc.com for more information
471
+ </description>
472
+ <example host.name="192.168.1.1">192.168.1.1 (IntraStore TurboSendmail) ESMTP Service ready</example>
473
+ <param pos="0" name="service.vendor" value="BT"/>
474
+ <param pos="0" name="service.family" value="IntraStore"/>
475
+ <param pos="0" name="service.product" value="IntraStore"/>
476
+ <param pos="1" name="host.name"/>
477
+ </fingerprint>
478
+ <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) \(.+\)$">
479
+ <description>JAMES SMTP Server</description>
480
+ <example host.name="foo.bar" service.version="2.3.2">foo.bar SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
481
+ <param pos="0" name="service.vendor" value="Apache"/>
482
+ <param pos="0" name="service.product" value="James"/>
483
+ <param pos="2" name="service.version"/>
484
+ <param pos="0" name="service.cpe23" value="cpe:/a:apache:james:{service.version}"/>
485
+ <param pos="1" name="host.name"/>
486
+ <param pos="3" name="system.time"/>
487
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
488
+ </fingerprint>
489
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: ([\d.]+)$">
490
+ <description>MailEnable - Simple</description>
491
+ <example service.version="9.53">ESMTP MailEnable Service, Version: 9.53</example>
492
+ <param pos="0" name="os.vendor" value="Microsoft"/>
493
+ <param pos="0" name="os.family" value="Windows"/>
494
+ <param pos="0" name="os.product" value="Windows"/>
495
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
496
+ <param pos="0" name="service.vendor" value="MailEnable"/>
497
+ <param pos="0" name="service.family" value="Mail Server"/>
498
+ <param pos="0" name="service.product" value="Mail Server"/>
499
+ <param pos="1" name="host.name"/>
500
+ <param pos="2" name="service.version"/>
501
+ <param pos="0" name="service.cpe23" value="cpe:/a:mailenable:mailenable:{service.version}"/>
502
+ </fingerprint>
503
+ <!-- MailEnable has an odd, three version string. Not sure about the meaning the second and third version #s. -->
504
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: (?:([\d.]+))?-[\d.]*-[\d.]* (?:ready|denied access) at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
505
+ <description>MailEnable - Complex</description>
506
+ <example host.name="foo.bar" service.version="1.8">foo.bar ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
507
+ <example host.name="foo.bar" service.version="9.53">foo.bar ESMTP MailEnable Service, Version: 9.53-9.53- ready at 11/30/17 00:57:37</example>
508
+ <example host.name="foo.bar" service.version="9.00" system.time="11/30/17 09:30:34">foo.bar ESMTP MailEnable Service, Version: 9.00--9.00 ready at 11/30/17 09:30:34</example>
509
+ <example host.name="foo.bar" service.version="1.986" system.time="04/05/18 16:15:25">foo.bar ESMTP MailEnable Service, Version: 1.986-- denied access at 04/05/18 16:15:25</example>
510
+ <param pos="0" name="os.vendor" value="Microsoft"/>
511
+ <param pos="0" name="os.family" value="Windows"/>
512
+ <param pos="0" name="os.product" value="Windows"/>
513
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
514
+ <param pos="0" name="service.vendor" value="MailEnable"/>
515
+ <param pos="0" name="service.family" value="Mail Server"/>
516
+ <param pos="0" name="service.product" value="Mail Server"/>
517
+ <param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
518
+ <param pos="1" name="host.name"/>
519
+ <param pos="2" name="service.version"/>
520
+ <param pos="0" name="service.cpe23" value="cpe:/a:mailenable:mailenable:{service.version}"/>
521
+ <param pos="3" name="system.time"/>
522
+ </fingerprint>
523
+ <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.[\d\.]+), (.+, .+)\) ESMTP Mail Server Ready. *$">
524
+ <description>Mail Max</description>
525
+ <example host.name="foo.bar" service.version="4.2.4.7">foo.bar (Mail-Max Version 4.2.4.7, Wed, 31 Jan 2001 03:44:35 +0100 WST) ESMTP Mail Server Ready.</example>
526
+ <example host.name="foo.bar" service.version="3.073">foo.bar (Mail-Max Version 3.073, Thu, 30 Nov 2017 17:24:59 +0800 ) ESMTP Mail Server Ready.</example>
527
+ <param pos="0" name="service.vendor" value="Mail-Max"/>
528
+ <param pos="0" name="service.family" value="Mail-Max"/>
529
+ <param pos="0" name="service.product" value="Mail-Max"/>
530
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
531
+ <param pos="1" name="host.name"/>
532
+ <param pos="2" name="service.version"/>
533
+ <param pos="3" name="system.time"/>
534
+ </fingerprint>
535
+ <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
536
+ <description>Rockliffe MailSite - with version (http://www.rockliffe.com)</description>
537
+ <example host.name="foo.bar" service.version="3.4.6.0">foo.bar MailSite ESMTP Receiver Version 3.4.6.0 Ready</example>
538
+ <example host.name="foo.bar" service.version="2.1.7">foo.bar MailSite SMTP Receiver Version 2.1.7 Ready</example>
539
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
540
+ <param pos="0" name="service.family" value="MailSite"/>
541
+ <param pos="0" name="service.product" value="MailSite"/>
542
+ <param pos="1" name="host.name"/>
543
+ <param pos="2" name="service.version"/>
544
+ </fingerprint>
545
+ <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Ready *$">
546
+ <description>Rockliffe MailSite - without version (http://www.rockliffe.com)</description>
547
+ <example host.name="foo.bar">foo.bar MailSite SMTP Receiver Ready</example>
548
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
549
+ <param pos="0" name="service.family" value="MailSite"/>
550
+ <param pos="0" name="service.product" value="MailSite"/>
551
+ <param pos="1" name="host.name"/>
552
+ </fingerprint>
553
+ <fingerprint pattern="^ ?MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
554
+ <description>Rockliffe MailSite - without hostname (http://www.rockliffe.com)</description>
555
+ <example service.version="10.2.0.0"> MailSite ESMTP Receiver Version 10.2.0.0 Ready</example>
556
+ <param pos="0" name="service.vendor" value="Rockliffe"/>
557
+ <param pos="0" name="service.family" value="MailSite"/>
558
+ <param pos="0" name="service.product" value="MailSite"/>
559
+ <param pos="1" name="service.version"/>
560
+ </fingerprint>
561
+ <fingerprint pattern="^([^ ]+) +MAILsweeper ESMTP Receiver Version (\d\.[\d.]+) Ready *$">
562
+ <description>Content Security MAILsweeper for SMTP (http://www.contenttechnologies.com/products/msw4smtp/default.asp)</description>
563
+ <example service.version="4.2.1.0">foo.bar MAILsweeper ESMTP Receiver Version 4.2.1.0 Ready</example>
564
+ <param pos="0" name="service.vendor" value="Clearswift"/>
565
+ <param pos="0" name="service.family" value="MAILsweeper"/>
566
+ <param pos="0" name="service.product" value="MAILsweeper"/>
567
+ <param pos="1" name="host.name"/>
568
+ <param pos="2" name="service.version"/>
569
+ </fingerprint>
570
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) UNREGISTERED; *(.+) *$">
571
+ <description>MDaemon mail server - with timestamp, unregistered</description>
572
+ <example service.version="4.0.5">foo.bar ESMTP MDaemon 4.0.5 UNREGISTERED; Sat, 06 Oct 2001 09:10:56 +0400</example>
573
+ <param pos="0" name="service.vendor" value="Alt-N"/>
574
+ <param pos="0" name="service.family" value="MDaemon"/>
575
+ <param pos="0" name="service.product" value="MDaemon"/>
576
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
577
+ <param pos="0" name="mdaemon.unregistered" value="yes"/>
578
+ <param pos="0" name="os.vendor" value="Microsoft"/>
579
+ <param pos="0" name="os.family" value="Windows"/>
580
+ <param pos="0" name="os.product" value="Windows"/>
581
+ <param pos="0" name="os.arch" value="x86"/>
582
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
583
+ <param pos="1" name="host.name"/>
584
+ <param pos="2" name="service.version"/>
585
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
586
+ <param pos="3" name="system.time"/>
587
+ </fingerprint>
588
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
589
+ <description>MDaemon mail server - with timestamp</description>
590
+ <example service.version="4.0.2">foo.bar ESMTP MDaemon 4.0.2; Sat, 06 Oct 2001 01:46:44 -0500</example>
591
+ <param pos="0" name="service.vendor" value="Alt-N"/>
592
+ <param pos="0" name="service.family" value="MDaemon"/>
593
+ <param pos="0" name="service.product" value="MDaemon"/>
594
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
595
+ <param pos="0" name="os.vendor" value="Microsoft"/>
596
+ <param pos="0" name="os.family" value="Windows"/>
597
+ <param pos="0" name="os.product" value="Windows"/>
598
+ <param pos="0" name="os.arch" value="x86"/>
599
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
600
+ <param pos="1" name="host.name"/>
601
+ <param pos="2" name="service.version"/>
602
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
603
+ <param pos="3" name="system.time"/>
604
+ </fingerprint>
605
+ <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
606
+ <description>MDaemon mail server - without timestamp</description>
607
+ <example service.version="3.5.7">foo.bar ESMTP MDaemon 3.5.7 ready</example>
608
+ <param pos="0" name="service.vendor" value="Alt-N"/>
609
+ <param pos="0" name="service.family" value="MDaemon"/>
610
+ <param pos="0" name="service.product" value="MDaemon"/>
611
+ <param pos="0" name="os.vendor" value="Microsoft"/>
612
+ <param pos="0" name="os.family" value="Windows"/>
613
+ <param pos="0" name="os.product" value="Windows"/>
614
+ <param pos="0" name="os.arch" value="x86"/>
615
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
616
+ <param pos="1" name="host.name"/>
617
+ <param pos="2" name="service.version"/>
618
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
619
+ </fingerprint>
620
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:using )?MDaemon v(\d+\.[\d.]+) ([^ ]+) *$">
621
+ <description>MDaemon mail server - with version revision</description>
622
+ <example service.version="2.84" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.84 R</example>
623
+ <example service.version="3.0.3" service.version.version="R">foo.bar ESMTP service ready [1] using MDaemon v3.0.3 R</example>
624
+ <example service.version="2.8.7.0" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.8.7.0 R</example>
625
+ <param pos="0" name="service.vendor" value="Alt-N"/>
626
+ <param pos="0" name="service.family" value="MDaemon"/>
627
+ <param pos="0" name="service.product" value="MDaemon"/>
628
+ <param pos="0" name="os.vendor" value="Microsoft"/>
629
+ <param pos="0" name="os.family" value="Windows"/>
630
+ <param pos="0" name="os.product" value="Windows"/>
631
+ <param pos="0" name="os.arch" value="x86"/>
632
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
633
+ <param pos="1" name="host.name"/>
634
+ <param pos="2" name="service.version"/>
635
+ <param pos="3" name="service.version.version"/>
636
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
637
+ </fingerprint>
638
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:\()?MDaemon v([\d.]+) ([^ ]+) ([^ )]+)(?:\))? *$">
639
+ <description>MDaemon mail server - with service pack</description>
640
+ <example service.version="2.7" service.version.version="SP5" service.version.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.7 SP5 R</example>
641
+ <example service.version="2.7" service.version.version="SP4" service.version.version.version="R">foo.bar ESMTP service ready [1] (MDaemon v2.7 SP4 R)</example>
642
+ <param pos="0" name="service.vendor" value="Alt-N"/>
643
+ <param pos="0" name="service.family" value="MDaemon"/>
644
+ <param pos="0" name="service.product" value="MDaemon"/>
645
+ <param pos="0" name="os.vendor" value="Microsoft"/>
646
+ <param pos="0" name="os.family" value="Windows"/>
647
+ <param pos="0" name="os.product" value="Windows"/>
648
+ <param pos="0" name="os.arch" value="x86"/>
649
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
650
+ <param pos="1" name="host.name"/>
651
+ <param pos="2" name="service.version"/>
652
+ <param pos="3" name="service.version.version"/>
653
+ <param pos="4" name="service.version.version.version"/>
654
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
655
+ </fingerprint>
656
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
657
+ <description>MDaemon mail server</description>
658
+ <example service.version="2.5" service.version.version.version="b1">foo.bar ESMTP service ready [1] (MDaemon v2.5 rB b1 32-T)</example>
659
+ <param pos="0" name="service.vendor" value="Alt-N"/>
660
+ <param pos="0" name="service.family" value="MDaemon"/>
661
+ <param pos="0" name="service.product" value="MDaemon"/>
662
+ <param pos="0" name="os.vendor" value="Microsoft"/>
663
+ <param pos="0" name="os.family" value="Windows"/>
664
+ <param pos="0" name="os.product" value="Windows"/>
665
+ <param pos="0" name="os.arch" value="x86"/>
666
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
667
+ <param pos="1" name="host.name"/>
668
+ <param pos="2" name="service.version"/>
669
+ <param pos="3" name="service.version.version"/>
670
+ <param pos="4" name="service.version.version.version"/>
671
+ <param pos="5" name="service.version.version.version.version"/>
672
+ <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:{service.version}"/>
673
+ </fingerprint>
674
+ <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
675
+ <fingerprint pattern="^([^ ]+) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
676
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
677
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar SMTP Merak 8.0.3; Thu, 30 Nov 2017 20:01:41 +1000</example>
678
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar ESMTP Merak 8.0.3; Thu, 30 Nov 2017 12:08:09 +0200</example>
679
+ <example host.name="foo.bar" service.version="2.10.284">foo.bar ESMTP MERAK 2.10.284; Thu, 30 Nov 2017 17:55:10 +0800</example>
680
+ <param pos="0" name="service.vendor" value="Merak"/>
681
+ <param pos="0" name="service.family" value="Mail Server"/>
682
+ <param pos="0" name="service.product" value="Mail Server"/>
683
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
684
+ <param pos="1" name="host.name"/>
685
+ <param pos="2" name="service.version"/>
686
+ <param pos="3" name="system.time"/>
687
+ </fingerprint>
688
+ <fingerprint pattern="^MERCUR SMTP-Server \(v([^ ]+\.[^ ])0\.([^ ]+) ([^ ]+)\) for (.+) ready at (.+) *$">
689
+ <description>Atrium's MERCUR SMTP server (http://www.atrium-software.com/pub/support_e.cfm)</description>
690
+ <example service.version="3.3" service.version.version="09" service.version.version.version="SA-0000005" mercur.os.info="Windows NT">MERCUR SMTP-Server (v3.30.09 SA-0000005) for Windows NT ready at Thu, 30 Nov 2017 10:01:06 +0100</example>
691
+ <param pos="0" name="service.vendor" value="Atrium Software"/>
692
+ <param pos="0" name="service.family" value="MERCUR"/>
693
+ <param pos="0" name="service.product" value="MERCUR"/>
694
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
695
+ <param pos="1" name="service.version"/>
696
+ <param pos="2" name="service.version.version"/>
697
+ <param pos="3" name="service.version.version.version"/>
698
+ <param pos="4" name="mercur.os.info"/>
699
+ <param pos="5" name="system.time"/>
700
+ </fingerprint>
701
+ <fingerprint pattern="^([^ ]+) Mercury ([^ ]+\.[^ ]+) ESMTP server ready.$">
702
+ <description>Mercury NLM for Netware ( http://www.pmail.com/index.cfm )</description>
703
+ <example service.version="1.43">foo.bar Mercury 1.43 ESMTP server ready.</example>
704
+ <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
705
+ <param pos="0" name="service.product" value="Mercury Mail Transport System"/>
706
+ <param pos="0" name="os.vendor" value="Novell"/>
707
+ <param pos="0" name="os.family" value="NetWare"/>
708
+ <param pos="0" name="os.product" value="NetWare"/>
709
+ <param pos="0" name="os.cpe23" value="cpe:/o:novell:netware:-"/>
710
+ <param pos="1" name="host.name"/>
711
+ <param pos="2" name="service.version"/>
712
+ </fingerprint>
713
+ <fingerprint pattern="^^([^ ]+) Mercury\/32 v([^ ]+\.[^ ]+) (?:SMTP\/)?ESMTP server ready.?$">
714
+ <description>Mercury/32 for Win9x/NT/2000 ( http://www.pmail.com/index.cfm )</description>
715
+ <example service.version="3.01a">foo.bar Mercury/32 v3.01a SMTP/ESMTP server ready.</example>
716
+ <example service.version="3.30">foo.bar Mercury/32 v3.30 ESMTP server ready.</example>
717
+ <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
718
+ <param pos="0" name="service.product" value="Mercury Mail Transport System"/>
719
+ <param pos="0" name="os.vendor" value="Microsoft"/>
720
+ <param pos="0" name="os.family" value="Windows"/>
721
+ <param pos="0" name="os.product" value="Windows"/>
722
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
723
+ <param pos="1" name="host.name"/>
724
+ <param pos="2" name="service.version"/>
725
+ </fingerprint>
726
+ <fingerprint pattern="^([^ ]+) SMTP NAVIEG ([^ ]+\.[^ ]+\.[^ ]+); (.+)* http.*$">
727
+ <description>Norton Antivirus for Internet Email Gateways (becomes NAVGW in 2.1)</description>
728
+ <example host.name="foo.bar" service.version="2.0.1">foo.bar SMTP NAVIEG 2.0.1; Sun, 29 Jul 2001 22:02:16 -0500 http://www.symantec.com</example>
729
+ <param pos="0" name="service.vendor" value="Norton"/>
730
+ <param pos="0" name="service.family" value="Antivirus for Gateways"/>
731
+ <param pos="0" name="service.product" value="Antivirus for Gateways"/>
732
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
733
+ <param pos="1" name="host.name"/>
734
+ <param pos="2" name="service.version"/>
735
+ <param pos="3" name="system.time"/>
736
+ </fingerprint>
737
+ <fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+) Patch ([^ ]+).*$">
738
+ <description>Netscape Messaging Server - with patch number</description>
739
+ <example host.name="foo.bar" service.version="4.15" service.version.version="7">foo.bar ESMTP service (Netscape Messaging Server 4.15 Patch 7 (built Sep 12 2001))</example>
740
+ <param pos="0" name="service.vendor" value="Netscape"/>
741
+ <param pos="0" name="service.family" value="Messaging Server"/>
742
+ <param pos="0" name="service.product" value="Messaging Server"/>
743
+ <param pos="1" name="host.name"/>
744
+ <param pos="2" name="service.version"/>
745
+ <param pos="3" name="service.version.version"/>
746
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
747
+ </fingerprint>
748
+ <fingerprint pattern="^([^ ]+) ESMTP server \(Netscape Messaging Server - Version ([\d.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
749
+ <description>Netscape Messaging Server - w/o patch number</description>
750
+ <example host.name="foo.bar" service.version="3.6" system.time="Thu, 30 Nov 2017 04:19:10 -0500">foo.bar ESMTP server (Netscape Messaging Server - Version 3.6) ready Thu, 30 Nov 2017 04:19:10 -0500</example>
751
+ <param pos="0" name="service.vendor" value="Netscape"/>
752
+ <param pos="0" name="service.family" value="Messaging Server"/>
753
+ <param pos="0" name="service.product" value="Messaging Server"/>
754
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
755
+ <param pos="1" name="host.name"/>
756
+ <param pos="2" name="service.version"/>
757
+ <param pos="0" name="service.cpe23" value="cpe:/a:netscape:messaging_server:{service.version}"/>
758
+ <param pos="3" name="system.time"/>
759
+ </fingerprint>
760
+ <fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
761
+ <description>Lotus Notes 4 SMTP MTA</description>
762
+ <example host.name="foo.bar">foo.bar Lotus SMTP MTA Service Ready</example>
763
+ <param pos="0" name="service.vendor" value="Lotus"/>
764
+ <param pos="0" name="service.family" value="Lotus Domino"/>
765
+ <param pos="0" name="service.product" value="Lotus Domino"/>
766
+ <param pos="0" name="service.version" value="4"/>
767
+ <param pos="1" name="host.name"/>
768
+ </fingerprint>
769
+ <!-- Branding is muddy here, IBM bought Lotus in 1995, server product wasn't
770
+ named Domino until Dec 1996 w/ v 4.5. Seems to have started being
771
+ called IBM Domino as of v9.0 on product and in banners.
772
+ -->
773
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(Lotus Domino Release (\d+\.[\w.]+(?: FP\d+)?(?: HF\d+)?)(?: \(Intl\))?\) ready at (.+) *$">
774
+ <description>Lotus Domino SMTP MTA</description>
775
+ <example service.version="8.5">foo.bar ESMTP Service (Lotus Domino Release 8.5) ready at Thu, 30 Nov 2017 17:01:45 +0800</example>
776
+ <example service.version="8.5.3FP6 HF1944">foo.bar ESMTP Service (Lotus Domino Release 8.5.3FP6 HF1944) ready at Thu, 30 Nov 2017 17:17:43 +0800</example>
777
+ <example service.version="8.0.2 FP1 HF82">foo.bar ESMTP Service (Lotus Domino Release 8.0.2 FP1 HF82) ready at Thu, 5 Apr 2018 22:03:28 +0200</example>
778
+ <example service.version="5.0.13a"> foo.bar ESMTP Service (Lotus Domino Release 5.0.13a) ready at Thu, 16 Nov 2017 17:47:42 +0800</example>
779
+ <example service.version="7.0.4">foo.bar ESMTP Service (Lotus Domino Release 7.0.4) ready at Thu, 16 Nov 2017 18:28:36 +0900</example>
780
+ <example service.version="8.0.2FP2">foo.bar ESMTP Service (Lotus Domino Release 8.0.2FP2) ready at Thu, 16 Nov 2017 02:17:33 -0700</example>
781
+ <example service.version="8.5.3">foo.bar ESMTP Service (Lotus Domino Release 8.5.3) ready at Thu, 16 Nov 2017 17:52:21 +0800</example>
782
+ <example service.version="7.0"> ESMTP Service (Lotus Domino Release 7.0) ready at Thu, 30 Nov 2017 17:00:41 +0800</example>
783
+ <example host.name="foo.bar" service.version="5.0.1">foo.bar ESMTP Service (Lotus Domino Release 5.0.1 (Intl)) ready at Thu, 30 Nov 2017 12:38:43 +0300</example>
784
+ <param pos="0" name="service.vendor" value="IBM"/>
785
+ <param pos="0" name="service.family" value="Lotus Domino"/>
786
+ <param pos="0" name="service.product" value="Lotus Domino"/>
787
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
788
+ <param pos="1" name="host.name"/>
789
+ <param pos="2" name="service.version"/>
790
+ <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
791
+ <param pos="3" name="system.time"/>
792
+ </fingerprint>
793
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(IBM Domino Release (\d+\.[\w.]+(?: HF\d+)?)\) ready at (.+) *$">
794
+ <description>IBM Domino SMTP MTA</description>
795
+ <example host.name="foo.bar" service.version="9.0.1FP8 HF475">foo.bar ESMTP Service (IBM Domino Release 9.0.1FP8 HF475) ready at Thu, 30 Nov 2017 17:55:48 +0900</example>
796
+ <example host.name="foo.bar" service.version="9.0.1"> foo.bar ESMTP Service (IBM Domino Release 9.0.1) ready at Thu, 30 Nov 2017 10:12:26 +0100</example>
797
+ <example service.version="9.0.1FP8"> ESMTP Service (IBM Domino Release 9.0.1FP8) ready at Thu, 30 Nov 2017 13:51:59 -0800</example>
798
+ <param pos="0" name="service.vendor" value="IBM"/>
799
+ <param pos="0" name="service.family" value="IBM Domino"/>
800
+ <param pos="0" name="service.product" value="IBM Domino"/>
801
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
802
+ <param pos="1" name="host.name"/>
803
+ <param pos="2" name="service.version"/>
804
+ <param pos="3" name="system.time"/>
805
+ </fingerprint>
806
+ <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Build (V?[\w.]+)\) ready at (.+) *$">
807
+ <description>Lotus Domino (some early build)</description>
808
+ <example notes.build.version="166.1">foo.bar ESMTP Service (Lotus Domino Build 166.1) ready at Thu, 16 Nov 2017 10:39:22 +0200</example>
809
+ <example notes.build.version="V85_M2_08202008">foo.bar ESMTP Service (Lotus Domino Build V85_M2_08202008) ready at Thu, 16 Nov 2017 03:57:40 -0500</example>
810
+ <param pos="0" name="service.vendor" value="Lotus"/>
811
+ <param pos="0" name="service.family" value="Lotus Domino"/>
812
+ <param pos="0" name="service.product" value="Lotus Domino"/>
813
+ <param pos="1" name="host.name"/>
814
+ <param pos="2" name="notes.build.version"/>
815
+ <param pos="3" name="system.time"/>
816
+ </fingerprint>
817
+ <fingerprint pattern="^Lotus Notes ESMTP Server X[^ ]+\.[^ ]+ on (.+) ready at (.+)\. *$">
818
+ <description>Lotus Notes 4.x with SMTP MTA add-on</description>
819
+ <example host.name="FooBar R45 Server/Foo Bar/US" system.time="Fri, 15 Feb 2002 09:46:19 -0800">Lotus Notes ESMTP Server X1.0 on FooBar R45 Server/Foo Bar/US ready at Fri, 15 Feb 2002 09:46:19 -0800.</example>
820
+ <param pos="0" name="service.vendor" value="Lotus"/>
821
+ <param pos="0" name="service.family" value="Lotus Domino"/>
822
+ <param pos="0" name="service.product" value="Lotus Domino"/>
823
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
824
+ <param pos="1" name="host.name"/>
825
+ <param pos="2" name="system.time"/>
826
+ </fingerprint>
827
+ <fingerprint pattern="^([^ ]+) NTMail \(v(\d+\.\d+\.\d+)/([^ ]+)\) ready for ESMTP transfer *$">
828
+ <description>NTMail (http://www.gordano.com)</description>
829
+ <example host.name="foo.bar" service.version="7.02.3037" ntmail.id="NU1319.01.5b000000">foo.bar NTMail (v7.02.3037/NU1319.01.5b000000) ready for ESMTP transfer </example>
830
+ <param pos="0" name="service.vendor" value="Gordano"/>
831
+ <param pos="0" name="service.family" value="NTMail"/>
832
+ <param pos="0" name="service.product" value="NTMail"/>
833
+ <param pos="1" name="host.name"/>
834
+ <param pos="2" name="service.version"/>
835
+ <param pos="3" name="ntmail.id"/>
836
+ </fingerprint>
837
+ <fingerprint pattern="^([^ ]+) WindowsNT SMTP Server v([^ ]+\.[^ ]+\.[^ ]+)/([^ ]+)/SP ESMTP ready at (.+) *$">
838
+ <description>NTMail - versions 3.x and earlier (it was called Internet Shopper's something or other)</description>
839
+ <example host.name="foo.bar" service.version="3.03.0018" ntmail.id="7.aavn">foo.bar WindowsNT SMTP Server v3.03.0018/7.aavn/SP ESMTP ready at Thu, 30 Nov 2017 10:15:31 +0100</example>
840
+ <param pos="0" name="service.vendor" value="Gordano"/>
841
+ <param pos="0" name="service.family" value="NTMail"/>
842
+ <param pos="0" name="service.product" value="NTMail"/>
843
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
844
+ <param pos="1" name="host.name"/>
845
+ <param pos="2" name="service.version"/>
846
+ <param pos="3" name="ntmail.id"/>
847
+ <param pos="4" name="system.time"/>
848
+ </fingerprint>
849
+ <fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
850
+ <description>Some unknown mail server on OpenVMS</description>
851
+ <example host.name="foo.bar" os.arch="IA64" os.version="8.4">foo.bar V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
852
+ <example host.name="foo.bar" os.arch="Alpha" os.version="7.3-2">foo.bar V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
853
+ <example host.name="foo.bar" os.arch="VAX" os.version="6.2">foo.bar UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
854
+ <example host.name="foo.bar" os.arch="Alpha" os.version="6.2-1H3">foo.bar UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
855
+ <param pos="1" name="host.name"/>
856
+ <param pos="0" name="os.vendor" value="HP"/>
857
+ <param pos="0" name="os.family" value="OpenVMS"/>
858
+ <param pos="0" name="os.product" value="OpenVMS"/>
859
+ <param pos="2" name="os.version"/>
860
+ <param pos="3" name="os.arch"/>
861
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:openvms:{os.version}"/>
862
+ </fingerprint>
863
+ <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\])? ([\d\.]+); (\w\w\w, +\d+ \w\w\w \d\d\d\d [\d:]+)$">
864
+ <description>A.K.I PMail</description>
865
+ <example host.name="foo.bar" service.version="1.91">foo.bar ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
866
+ <example host.name="foo.bar" service.version="1.78">foo.bar ESMTP PMailServer 1.78; Fri, 6 Apr 2018 04:34:11</example>
867
+ <param pos="0" name="service.vendor" value="A.K.I Software"/>
868
+ <param pos="0" name="service.product" value="PMail Server"/>
869
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss"/>
870
+ <param pos="1" name="host.name"/>
871
+ <param pos="2" name="service.version"/>
872
+ <param pos="3" name="system.time"/>
873
+ </fingerprint>
874
+ <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
875
+ <description>Postfix - version + build, followed by os</description>
876
+ <param pos="0" name="service.family" value="Postfix"/>
877
+ <param pos="0" name="service.product" value="Postfix"/>
878
+ <param pos="1" name="host.name"/>
879
+ <param pos="2" name="service.version"/>
880
+ <param pos="3" name="service.version.version"/>
881
+ <param pos="4" name="postfix.os.info"/>
882
+ </fingerprint>
883
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \(?([\d.]+)\)?$">
884
+ <description>Postfix - Std semantic versioning, w/ optional parens</description>
885
+ <example service.version="3.1.4">foo.bar ESMTP Postfix (3.1.4)</example>
886
+ <example service.version="2.7.1">foo.bar ESMTP Postfix 2.7.1</example>
887
+ <param pos="0" name="service.family" value="Postfix"/>
888
+ <param pos="0" name="service.product" value="Postfix"/>
889
+ <param pos="1" name="host.name"/>
890
+ <param pos="2" name="service.version"/>
891
+ </fingerprint>
892
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \((?:Postfix-)?([\d.]+)-([^ ]+)\)$">
893
+ <description>Postfix - version + build</description>
894
+ <example service.version="2.8" service.version.version="20100306">foo.bar ESMTP Postfix (2.8-20100306)</example>
895
+ <param pos="0" name="service.family" value="Postfix"/>
896
+ <param pos="0" name="service.product" value="Postfix"/>
897
+ <param pos="1" name="host.name"/>
898
+ <param pos="2" name="service.version"/>
899
+ <param pos="3" name="service.version.version"/>
900
+ </fingerprint>
901
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Ubuntu\)$">
902
+ <description>Postfix - Ubuntu</description>
903
+ <example>foo.bar ESMTP Postfix (Ubuntu)</example>
904
+ <param pos="0" name="service.family" value="Postfix"/>
905
+ <param pos="0" name="service.product" value="Postfix"/>
906
+ <param pos="1" name="host.name"/>
907
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
908
+ <param pos="0" name="os.family" value="Linux"/>
909
+ <param pos="0" name="os.product" value="Linux"/>
910
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
911
+ </fingerprint>
912
+ <fingerprint pattern="^([^ ]+)(?: ESMTP)? Hi, I'm a Mail-in-a-Box \(Ubuntu/Postfix; see https://mailinabox.email/\)$">
913
+ <description>Postfix - Ubuntu, Mail-in-a-Box package</description>
914
+ <example>foo.bar ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
915
+ <example>foo.bar Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
916
+ <param pos="0" name="service.family" value="Postfix"/>
917
+ <param pos="0" name="service.product" value="Postfix"/>
918
+ <param pos="1" name="host.name"/>
919
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
920
+ <param pos="0" name="os.family" value="Linux"/>
921
+ <param pos="0" name="os.product" value="Linux"/>
922
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
923
+ </fingerprint>
924
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Debian/GNU\)$">
925
+ <description>Postfix - Debian</description>
926
+ <example>foo.bar ESMTP Postfix (Debian/GNU)</example>
927
+ <param pos="0" name="service.family" value="Postfix"/>
928
+ <param pos="0" name="service.product" value="Postfix"/>
929
+ <param pos="1" name="host.name"/>
930
+ <param pos="0" name="os.vendor" value="Debian"/>
931
+ <param pos="0" name="os.family" value="Linux"/>
932
+ <param pos="0" name="os.product" value="Linux"/>
933
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
934
+ </fingerprint>
935
+ <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
936
+ <description>Postfix - generic banner with amusing comments in parentheses</description>
937
+ <example>foo.bar ESMTP Postfix (lol)</example>
938
+ <param pos="0" name="service.family" value="Postfix"/>
939
+ <param pos="0" name="service.product" value="Postfix"/>
940
+ <param pos="1" name="host.name"/>
941
+ </fingerprint>
942
+ <fingerprint pattern="^(?i)([^ ]+) +E?SMTP.* Postfix *$">
943
+ <description>Postfix - generic banner</description>
944
+ <example>foo.bar ESMTP Postfix</example>
945
+ <example>foo.bar SMTP Postfix</example>
946
+ <param pos="0" name="service.family" value="Postfix"/>
947
+ <param pos="0" name="service.product" value="Postfix"/>
948
+ <param pos="1" name="host.name"/>
949
+ </fingerprint>
950
+ <fingerprint pattern="^ *ESMTP Postfix$">
951
+ <description>Postfix - banner without hostname or version</description>
952
+ <example>ESMTP Postfix</example>
953
+ <param pos="0" name="service.family" value="Postfix"/>
954
+ <param pos="0" name="service.product" value="Postfix"/>
955
+ </fingerprint>
956
+ <fingerprint pattern="^(?i)([^ ]+) POSTFIX$">
957
+ <description>Postfix - generic w/o ESMTP</description>
958
+ <example host.name="foo.bar">foo.bar Postfix</example>
959
+ <param pos="0" name="service.family" value="Postfix"/>
960
+ <param pos="0" name="service.product" value="Postfix"/>
961
+ <param pos="1" name="host.name"/>
962
+ </fingerprint>
963
+ <fingerprint pattern="^([^ ]+) ESMTP server \((?i:P)ost\.(?i:O)ffice v([^ ]+\.[^ ]+)(?: release)? (.+) ID# ([^ ]+)\) ready (.+) *$">
964
+ <description>Post.Office</description>
965
+ <example host.name="foo.bar" service.version="3.8.4" postoffice.build="116" postoffice.id="1001-65749U100L10S0V38" system.time="Thu, 30 Nov 2017 18:46:24 +0900">foo.bar ESMTP server (post.office v3.8.4 release 116 ID# 1001-65749U100L10S0V38) ready Thu, 30 Nov 2017 18:46:24 +0900</example>
966
+ <example host.name="foo.bar" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">foo.bar ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>
967
+ <param pos="0" name="service.family" value="Post.Office"/>
968
+ <param pos="0" name="service.product" value="Post.Office"/>
969
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
970
+ <param pos="1" name="host.name"/>
971
+ <param pos="2" name="service.version"/>
972
+ <param pos="3" name="postoffice.build"/>
973
+ <param pos="4" name="postoffice.id"/>
974
+ <param pos="5" name="system.time"/>
975
+ </fingerprint>
976
+ <fingerprint pattern="^([^ ]+) Generic SMTP handler *$">
977
+ <description>Raptor Firewall (low confidence)</description>
978
+ <example host.name="foo.bar">foo.bar Generic SMTP handler</example>
979
+ <param pos="0" name="service.product" value="raptor"/>
980
+ <param pos="1" name="host.name"/>
981
+ </fingerprint>
982
+ <fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
983
+ <description>SAP SMTP Server</description>
984
+ <example host.name="foo.bar" service.version="8.04(53)">foo.bar SAP 8.04(53) ESMTP service ready</example>
985
+ <param pos="0" name="service.vendor" value="SAP"/>
986
+ <param pos="0" name="service.product" value="SMTP"/>
987
+ <param pos="2" name="service.version"/>
988
+ <param pos="1" name="host.name"/>
989
+ </fingerprint>
990
+ <fingerprint pattern="^Sendmail ESMTP ready$">
991
+ <description>Sendmail - short banner w/o hostname, version, platform, or date.</description>
992
+ <example>Sendmail ESMTP ready</example>
993
+ <param pos="0" name="service.family" value="Sendmail"/>
994
+ <param pos="0" name="service.product" value="Sendmail"/>
995
+ </fingerprint>
996
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
997
+ <description>Sendmail - HP-UX with a PHNE (HP Networking patch) installed</description>
998
+ <example host.name="foo.bar" service.version="8.8.6" sendmail.config.version="8.7.1">foo.bar ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT)</example>
999
+ <param pos="0" name="service.family" value="Sendmail"/>
1000
+ <param pos="0" name="service.product" value="Sendmail"/>
1001
+ <param pos="0" name="os.vendor" value="HP"/>
1002
+ <param pos="0" name="os.family" value="HP-UX"/>
1003
+ <param pos="0" name="os.product" value="HP-UX"/>
1004
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
1005
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1006
+ <param pos="1" name="host.name"/>
1007
+ <param pos="2" name="service.version"/>
1008
+ <param pos="3" name="sendmail.hpux.phne.version"/>
1009
+ <param pos="4" name="sendmail.config.version"/>
1010
+ <param pos="5" name="system.time"/>
1011
+ </fingerprint>
1012
+ <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w\w\w)$">
1013
+ <description>Sendmail - HP-UX</description>
1014
+ <example host.name="foo.bar" os.version="11.31" service.version="8.13.3">foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
1015
+ <param pos="0" name="service.family" value="Sendmail"/>
1016
+ <param pos="0" name="service.product" value="Sendmail"/>
1017
+ <param pos="0" name="os.vendor" value="HP"/>
1018
+ <param pos="0" name="os.family" value="HP-UX"/>
1019
+ <param pos="0" name="os.product" value="HP-UX"/>
1020
+ <param pos="3" name="os.version"/>
1021
+ <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:{os.version}"/>
1022
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1023
+ <param pos="1" name="host.name"/>
1024
+ <param pos="2" name="service.version"/>
1025
+ <param pos="4" name="system.time"/>
1026
+ </fingerprint>
1027
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
1028
+ <description>Sendmail - Unixware</description>
1029
+ <example service.version="8.8.7">foo.bar ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300)</example>
1030
+ <param pos="0" name="service.family" value="Sendmail"/>
1031
+ <param pos="0" name="service.product" value="Sendmail"/>
1032
+ <param pos="0" name="os.vendor" value="SCO"/>
1033
+ <param pos="0" name="os.family" value="UnixWare"/>
1034
+ <param pos="0" name="os.product" value="UnixWare"/>
1035
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1036
+ <param pos="1" name="host.name"/>
1037
+ <param pos="2" name="service.version"/>
1038
+ <param pos="3" name="os.version"/>
1039
+ <param pos="4" name="system.time"/>
1040
+ </fingerprint>
1041
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/UCB ([^;]+); (.+) \(.+\)$">
1042
+ <description>Sendmail - AIX (UCB variant)</description>
1043
+ <example os.version="4.2" service.version="8.7">foo.bar ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1044
+ <param pos="0" name="service.family" value="Sendmail"/>
1045
+ <param pos="0" name="service.product" value="Sendmail"/>
1046
+ <param pos="0" name="os.vendor" value="IBM"/>
1047
+ <param pos="0" name="os.family" value="AIX"/>
1048
+ <param pos="0" name="os.product" value="AIX"/>
1049
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1050
+ <param pos="1" name="host.name"/>
1051
+ <param pos="2" name="os.version"/>
1052
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1053
+ <param pos="3" name="service.version"/>
1054
+ <param pos="4" name="system.time"/>
1055
+ </fingerprint>
1056
+ <fingerprint pattern="^([^ ]+) Sendmail AIX([^/]+)/UCB ([^/]+)/([^ ]+) ready at (.+)$">
1057
+ <description>Sendmail - AIX (UCB/ready at variant)</description>
1058
+ <example>foo.bar Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500</example>
1059
+ <param pos="0" name="service.family" value="Sendmail"/>
1060
+ <param pos="0" name="service.product" value="Sendmail"/>
1061
+ <param pos="0" name="os.vendor" value="IBM"/>
1062
+ <param pos="0" name="os.family" value="AIX"/>
1063
+ <param pos="0" name="os.product" value="AIX"/>
1064
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1065
+ <param pos="1" name="host.name"/>
1066
+ <param pos="2" name="os.version"/>
1067
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1068
+ <param pos="3" name="service.version"/>
1069
+ <param pos="4" name="sendmail.config.version"/>
1070
+ <param pos="5" name="system.time"/>
1071
+ </fingerprint>
1072
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+)(?: \(.+\))?$">
1073
+ <description>Sendmail - AIX</description>
1074
+ <example host.name="foo.bar" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">foo.bar ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1075
+ <example host.name="foo.bar" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">foo.bar ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
1076
+ <param pos="0" name="service.family" value="Sendmail"/>
1077
+ <param pos="0" name="service.product" value="Sendmail"/>
1078
+ <param pos="0" name="os.vendor" value="IBM"/>
1079
+ <param pos="0" name="os.family" value="AIX"/>
1080
+ <param pos="0" name="os.product" value="AIX"/>
1081
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1082
+ <param pos="1" name="host.name"/>
1083
+ <param pos="2" name="os.version"/>
1084
+ <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:{os.version}"/>
1085
+ <param pos="3" name="service.version"/>
1086
+ <param pos="4" name="sendmail.config.version"/>
1087
+ <param pos="5" name="system.time"/>
1088
+ </fingerprint>
1089
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/SuSE Linux ([^;]+); (.+)$">
1090
+ <description>Sendmail - SuSE Linux</description>
1091
+ <example>foo.bar ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200</example>
1092
+ <param pos="0" name="service.family" value="Sendmail"/>
1093
+ <param pos="0" name="service.product" value="Sendmail"/>
1094
+ <param pos="0" name="os.vendor" value="SuSE"/>
1095
+ <param pos="0" name="os.family" value="Linux"/>
1096
+ <param pos="0" name="os.product" value="Linux"/>
1097
+ <param pos="0" name="os.cpe23" value="cpe:/o:suse:linux:-"/>
1098
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1099
+ <param pos="1" name="host.name"/>
1100
+ <param pos="2" name="service.version"/>
1101
+ <param pos="3" name="sendmail.config.version"/>
1102
+ <param pos="4" name="sendmail.vendor.version"/>
1103
+ <param pos="5" name="system.time"/>
1104
+ </fingerprint>
1105
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+); (.+)$">
1106
+ <description>Sendmail - Solaris with date (no time offeset variant)</description>
1107
+ <example>foo.bar ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT</example>
1108
+ <param pos="0" name="service.family" value="Sendmail"/>
1109
+ <param pos="0" name="service.product" value="Sendmail"/>
1110
+ <param pos="0" name="os.vendor" value="Sun"/>
1111
+ <param pos="0" name="os.family" value="Solaris"/>
1112
+ <param pos="0" name="os.product" value="Solaris"/>
1113
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1114
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1115
+ <param pos="1" name="host.name"/>
1116
+ <param pos="2" name="service.version"/>
1117
+ <param pos="3" name="sendmail.config.version"/>
1118
+ <param pos="4" name="system.time"/>
1119
+ </fingerprint>
1120
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+) ready at (.+) \(.+\)$">
1121
+ <description>Sendmail - Solaris with date (ready variant)</description>
1122
+ <example>foo.bar ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST)</example>
1123
+ <param pos="0" name="service.family" value="Sendmail"/>
1124
+ <param pos="0" name="service.product" value="Sendmail"/>
1125
+ <param pos="0" name="os.vendor" value="Sun"/>
1126
+ <param pos="0" name="os.family" value="Solaris"/>
1127
+ <param pos="0" name="os.product" value="Solaris"/>
1128
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1129
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1130
+ <param pos="1" name="host.name"/>
1131
+ <param pos="2" name="service.version"/>
1132
+ <param pos="3" name="sendmail.config.version"/>
1133
+ <param pos="4" name="system.time"/>
1134
+ </fingerprint>
1135
+ <fingerprint pattern="^([^ ]+) ESMTP (?:Debian )?Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
1136
+ <description>Sendmail - Debian</description>
1137
+ <example service.version="8.12.0.Beta7" sendmail.config.version="8.12.0.Beta7" sendmail.vendor.version="8.12.0.Beta7-1">foo.bar ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800</example>
1138
+ <example service.version="8.11.0" sendmail.config.version="8.9.3" sendmail.vendor.version="8.9.3-21">foo.bar ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700</example>
1139
+ <param pos="0" name="service.family" value="Sendmail"/>
1140
+ <param pos="0" name="service.product" value="Sendmail"/>
1141
+ <param pos="0" name="os.vendor" value="Debian"/>
1142
+ <param pos="0" name="os.family" value="Linux"/>
1143
+ <param pos="0" name="os.product" value="Linux"/>
1144
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1145
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1146
+ <param pos="1" name="host.name"/>
1147
+ <param pos="2" name="service.version"/>
1148
+ <param pos="3" name="sendmail.config.version"/>
1149
+ <param pos="4" name="sendmail.vendor.version"/>
1150
+ <param pos="5" name="system.time"/>
1151
+ </fingerprint>
1152
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+(?:wheezy|deb7u)\d; (.+); .*$">
1153
+ <description>Sendmail - Debian 7.x (wheezy)</description>
1154
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+wheezy1; Thu, 30 Nov 2017 10:33:05 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1155
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+deb7u1; Thu, 30 Nov 2017 11:00:33 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1156
+ <param pos="0" name="service.family" value="Sendmail"/>
1157
+ <param pos="0" name="service.product" value="Sendmail"/>
1158
+ <param pos="0" name="os.vendor" value="Debian"/>
1159
+ <param pos="0" name="os.family" value="Linux"/>
1160
+ <param pos="0" name="os.product" value="Linux"/>
1161
+ <param pos="0" name="os.version" value="7.0"/>
1162
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:7.0"/>
1163
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1164
+ <param pos="1" name="host.name"/>
1165
+ <param pos="2" name="service.version"/>
1166
+ <param pos="3" name="sendmail.config.version"/>
1167
+ <param pos="4" name="system.time"/>
1168
+ </fingerprint>
1169
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+deb8u\d; (.+); .*$">
1170
+ <description>Sendmail - Debian 8.x (jessie)</description>
1171
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-8+deb8u2; Thu, 30 Nov 2017 10:25:48 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1172
+ <param pos="0" name="service.family" value="Sendmail"/>
1173
+ <param pos="0" name="service.product" value="Sendmail"/>
1174
+ <param pos="0" name="os.vendor" value="Debian"/>
1175
+ <param pos="0" name="os.family" value="Linux"/>
1176
+ <param pos="0" name="os.product" value="Linux"/>
1177
+ <param pos="0" name="os.version" value="8.0"/>
1178
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
1179
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1180
+ <param pos="1" name="host.name"/>
1181
+ <param pos="2" name="service.version"/>
1182
+ <param pos="3" name="sendmail.config.version"/>
1183
+ <param pos="4" name="system.time"/>
1184
+ </fingerprint>
1185
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+lenny\d; (.+); .*$">
1186
+ <description>Sendmail - Debian 5.x (lenny)</description>
1187
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-5+lenny1; Thu, 30 Nov 2017 12:29:40 +0300; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1188
+ <param pos="0" name="service.family" value="Sendmail"/>
1189
+ <param pos="0" name="service.product" value="Sendmail"/>
1190
+ <param pos="0" name="os.vendor" value="Debian"/>
1191
+ <param pos="0" name="os.family" value="Linux"/>
1192
+ <param pos="0" name="os.product" value="Linux"/>
1193
+ <param pos="0" name="os.version" value="5.0"/>
1194
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:5.0"/>
1195
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1196
+ <param pos="1" name="host.name"/>
1197
+ <param pos="2" name="service.version"/>
1198
+ <param pos="3" name="sendmail.config.version"/>
1199
+ <param pos="4" name="system.time"/>
1200
+ </fingerprint>
1201
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+etch\d; (.+); .*$">
1202
+ <description>Sendmail - Debian 4.x (etch)</description>
1203
+ <example service.version="8.13.8" sendmail.config.version="8.13.8">foo.bar ESMTP Sendmail 8.13.8/8.13.8/Debian-3+etch1; Thu, 30 Nov 2017 10:28:23 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1204
+ <param pos="0" name="service.family" value="Sendmail"/>
1205
+ <param pos="0" name="service.product" value="Sendmail"/>
1206
+ <param pos="0" name="os.vendor" value="Debian"/>
1207
+ <param pos="0" name="os.family" value="Linux"/>
1208
+ <param pos="0" name="os.product" value="Linux"/>
1209
+ <param pos="0" name="os.version" value="4.0"/>
1210
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:4.0"/>
1211
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1212
+ <param pos="1" name="host.name"/>
1213
+ <param pos="2" name="service.version"/>
1214
+ <param pos="3" name="sendmail.config.version"/>
1215
+ <param pos="4" name="system.time"/>
1216
+ </fingerprint>
1217
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\dsarge\d; (.+); .*$">
1218
+ <description>Sendmail - Debian 3.1 (sarge)</description>
1219
+ <example service.version="8.13.4">foo.bar ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge1; Thu, 30 Nov 2017 10:55:47 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1220
+ <param pos="0" name="service.family" value="Sendmail"/>
1221
+ <param pos="0" name="service.product" value="Sendmail"/>
1222
+ <param pos="0" name="os.vendor" value="Debian"/>
1223
+ <param pos="0" name="os.family" value="Linux"/>
1224
+ <param pos="0" name="os.product" value="Linux"/>
1225
+ <param pos="0" name="os.version" value="3.1"/>
1226
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:3.1"/>
1227
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1228
+ <param pos="1" name="host.name"/>
1229
+ <param pos="2" name="service.version"/>
1230
+ <param pos="3" name="sendmail.config.version"/>
1231
+ <param pos="4" name="system.time"/>
1232
+ </fingerprint>
1233
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d(?:\.\d)?(?:build\d)?;+ (.+); .*$">
1234
+ <description>Sendmail - Debian patch only</description>
1235
+ <example service.version="8.15.2">foo.bar ESMTP Sendmail 8.15.2/8.15.2/Debian-3; Thu, 30 Nov 2017 10:55:50 +0200; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1236
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-9.4; Thu, 30 Nov 2017 10:11:54 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1237
+ <example service.version="8.14.2">foo.bar ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Thu, 30 Nov 2017 04:09:50 -0600; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1238
+ <param pos="0" name="service.family" value="Sendmail"/>
1239
+ <param pos="0" name="service.product" value="Sendmail"/>
1240
+ <param pos="0" name="os.vendor" value="Debian"/>
1241
+ <param pos="0" name="os.family" value="Linux"/>
1242
+ <param pos="0" name="os.product" value="Linux"/>
1243
+ <param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:-"/>
1244
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1245
+ <param pos="1" name="host.name"/>
1246
+ <param pos="2" name="service.version"/>
1247
+ <param pos="3" name="sendmail.config.version"/>
1248
+ <param pos="4" name="system.time"/>
1249
+ </fingerprint>
1250
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/[^/]+/Debian-[\d.]+ubuntu[^ ]*; (.+); .*$">
1251
+ <description>Sendmail - Ubuntu</description>
1252
+ <example service.version="8.13.5.20060308">foo.bar ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1253
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4.1ubuntu1; Thu, 30 Nov 2017 11:00:30 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1254
+ <param pos="0" name="service.family" value="Sendmail"/>
1255
+ <param pos="0" name="service.product" value="Sendmail"/>
1256
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
1257
+ <param pos="0" name="os.family" value="Linux"/>
1258
+ <param pos="0" name="os.product" value="Linux"/>
1259
+ <param pos="0" name="os.cpe23" value="cpe:/o:canonical:ubuntu_linux:-"/>
1260
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1261
+ <param pos="1" name="host.name"/>
1262
+ <param pos="2" name="service.version"/>
1263
+ <param pos="3" name="system.time"/>
1264
+ </fingerprint>
1265
+ <fingerprint pattern="^([^ ]+) (?:E?SMTP )?Sendmail SMI-([^/]+)/(SMI-SVR4) ready at (.+)$">
1266
+ <description>Sendmail - Solaris (SMI variant)</description>
1267
+ <example>foo.bar Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400</example>
1268
+ <param pos="0" name="service.family" value="Sendmail"/>
1269
+ <param pos="0" name="service.product" value="Sendmail"/>
1270
+ <param pos="0" name="os.vendor" value="Sun"/>
1271
+ <param pos="0" name="os.family" value="SunOS"/>
1272
+ <param pos="0" name="os.product" value="Solaris"/>
1273
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1274
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1275
+ <param pos="1" name="host.name"/>
1276
+ <param pos="2" name="service.version"/>
1277
+ <param pos="3" name="sendmail.config.version"/>
1278
+ <param pos="4" name="system.time"/>
1279
+ </fingerprint>
1280
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)/(linuxconf); (.+)$">
1281
+ <description>Sendmail - unknown platform (linuxconf variant)</description>
1282
+ <example>foo.bar ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400</example>
1283
+ <param pos="0" name="service.family" value="Sendmail"/>
1284
+ <param pos="0" name="service.product" value="Sendmail"/>
1285
+ <param pos="0" name="os.family" value="Linux"/>
1286
+ <param pos="0" name="os.product" value="Linux"/>
1287
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1288
+ <param pos="1" name="host.name"/>
1289
+ <param pos="2" name="service.version"/>
1290
+ <param pos="3" name="sendmail.config.version"/>
1291
+ <param pos="4" name="system.time"/>
1292
+ </fingerprint>
1293
+ <fingerprint pattern="^([^ ]+) ESMTP MetaInfo Sendmail ([^ ]+) Build ([^ ]+) \(Berkeley ([^ ]+)\)/([^;]+); (.+)$">
1294
+ <description>Sendmail - MetaInfo</description>
1295
+ <example host.name="foo.bar" service.version="8.8.6">foo.bar ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1296
+ <param pos="0" name="service.vendor" value="MetaInfo"/>
1297
+ <param pos="0" name="service.family" value="Sendmail"/>
1298
+ <param pos="0" name="service.product" value="Sendmail"/>
1299
+ <param pos="0" name="os.vendor" value="Microsoft"/>
1300
+ <param pos="0" name="os.family" value="Windows"/>
1301
+ <param pos="0" name="os.product" value="Windows NT"/>
1302
+ <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_nt:-"/>
1303
+ <param pos="0" name="system.time.format" value="EEE, d MMM"/>
1304
+ <param pos="1" name="host.name"/>
1305
+ <param pos="2" name="metainfo.version"/>
1306
+ <param pos="3" name="metainfo.version.version"/>
1307
+ <param pos="4" name="service.version"/>
1308
+ <param pos="5" name="sendmail.config.version"/>
1309
+ <param pos="6" name="system.time"/>
1310
+ </fingerprint>
1311
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1312
+ <description>Sendmail - optional timezone and timestamp, w/o OS</description>
1313
+ <example host.name="foo.bar" service.version="8.9.3+3.4W" sendmail.config.version="8.9.3+3.4W" system.time="Tue, 30 Jan 2001 20:40:09 -0500">foo.bar ESMTP Sendmail 8.9.3+3.4W/8.9.3+3.4W; Tue, 30 Jan 2001 20:40:09 -0500 (EST)</example>
1314
+ <example host.name="foo.bar" service.version="8.12.10" sendmail.config.version="8.12.10">foo.bar ESMTP Sendmail 8.12.10/8.12.10;</example>
1315
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1316
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1317
+ <example host.name="foo.bar" service.version="8.10.2" sendmail.config.version="8.10.3">foo.bar ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
1318
+ <example host.name="foo.bar" service.version="8.13.8" sendmail.config.version="8.13.9">foo.bar ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
1319
+ <param pos="0" name="service.product" value="Sendmail"/>
1320
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1321
+ <param pos="1" name="host.name"/>
1322
+ <param pos="2" name="service.version"/>
1323
+ <param pos="3" name="sendmail.config.version"/>
1324
+ <param pos="4" name="system.time"/>
1325
+ </fingerprint>
1326
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w+)\.?$">
1327
+ <description>Sendmail - with timezone and timestamp, w/o timezone offset or OS</description>
1328
+ <example host.name="foo.bar" service.version="8.14.4" sendmail.config.version="8.14.4" system.time="Thu, 5 Apr 2018 19:30:58 GMT">foo.bar ESMTP Sendmail 8.14.4/8.14.4; Thu, 5 Apr 2018 19:30:58 GMT</example>
1329
+ <param pos="0" name="service.product" value="Sendmail"/>
1330
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1331
+ <param pos="1" name="host.name"/>
1332
+ <param pos="2" name="service.version"/>
1333
+ <param pos="3" name="sendmail.config.version"/>
1334
+ <param pos="4" name="system.time"/>
1335
+ </fingerprint>
1336
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ ]+) ready at *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\))$">
1337
+ <description>Sendmail - with version and date (optional timezone), w/o config version</description>
1338
+ <example host.name="foo.bar" service.version="8.8.8" system.time="Tue, 6 Feb 2001 14:37:14 +0100">foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET)</example>
1339
+ <param pos="0" name="service.family" value="Sendmail"/>
1340
+ <param pos="0" name="service.product" value="Sendmail"/>
1341
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1342
+ <param pos="1" name="host.name"/>
1343
+ <param pos="2" name="service.version"/>
1344
+ <param pos="3" name="system.time"/>
1345
+ </fingerprint>
1346
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) - \([^\)]+\)/[^ ]+;? *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1347
+ <description>Sendmail - revision variant 1</description>
1348
+ <example>foo.foo.bar ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST)</example>
1349
+ <param pos="0" name="service.family" value="Sendmail"/>
1350
+ <param pos="0" name="service.product" value="Sendmail"/>
1351
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1352
+ <param pos="1" name="host.name"/>
1353
+ <param pos="2" name="service.version"/>
1354
+ <param pos="3" name="system.time"/>
1355
+ </fingerprint>
1356
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +(?:[^ ]+) +version +([^ ]+) +- +(?:[^;]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1357
+ <description>Sendmail - revision variant 2</description>
1358
+ <example>foo.foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT)</example>
1359
+ <param pos="0" name="service.family" value="Sendmail"/>
1360
+ <param pos="0" name="service.product" value="Sendmail"/>
1361
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1362
+ <param pos="1" name="host.name"/>
1363
+ <param pos="2" name="service.version"/>
1364
+ <param pos="3" name="system.time"/>
1365
+ </fingerprint>
1366
+ <fingerprint pattern="^(?i)([^ ]+) +(?:ESMTP +)?Sendmail *(?: Ready.? ?)?(?:;|at)? ?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1367
+ <description>Sendmail - with date, w/o version or platform, optional status string.</description>
1368
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ; Thu, 30 Nov 2017 17:50:14 +0900</example>
1369
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail; Thu, 30 Nov 2017 17:50:14 +0900</example>
1370
+ <example host.name="foo.bar" system.time="Wed, 20 May 2015 17:17:56 -0600">foo.bar ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1371
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 10:24:14 +0100">foo.bar ESMTP Sendmail Ready; Thu, 30 Nov 2017 10:24:14 +0100</example>
1372
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready at Fri, 6 Apr 2018 04:57:01 +0900</example>
1373
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready</example>
1374
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready. </example>
1375
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail</example>
1376
+ <example host.name="foo.bar">foo.bar Sendmail ready. </example>
1377
+ <param pos="0" name="service.family" value="Sendmail"/>
1378
+ <param pos="0" name="service.product" value="Sendmail"/>
1379
+ <param pos="1" name="host.name"/>
1380
+ <param pos="2" name="system.time"/>
1381
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1382
+ </fingerprint>
1383
+ <fingerprint pattern="^ESMTP Sendmail +([^/ ]+) */ *([^/ ]+); (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)$">
1384
+ <description>Sendmail - with version and date, w/o hostname or platform (semicolon variant)</description>
1385
+ <example service.version="8.13.1" sendmail.config.version="8.13.1" system.time="Thu, 30 Nov 2017 01:58:22 -0700">ESMTP Sendmail 8.13.1/8.13.1; Thu, 30 Nov 2017 01:58:22 -0700</example>
1386
+ <param pos="0" name="service.family" value="Sendmail"/>
1387
+ <param pos="0" name="service.product" value="Sendmail"/>
1388
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1389
+ <param pos="1" name="service.version"/>
1390
+ <param pos="2" name="sendmail.config.version"/>
1391
+ <param pos="3" name="system.time"/>
1392
+ </fingerprint>
1393
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) \([^\)]+\) *(.+) \(.+\)$">
1394
+ <description>Sendmail - unknown (date in version string variant)</description>
1395
+ <example>mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET)</example>
1396
+ <param pos="0" name="service.family" value="Sendmail"/>
1397
+ <param pos="0" name="service.product" value="Sendmail"/>
1398
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1399
+ <param pos="1" name="host.name"/>
1400
+ <param pos="2" name="service.version"/>
1401
+ <param pos="3" name="system.time"/>
1402
+ </fingerprint>
1403
+ <!-- *Sendmail* fingerprints after this line had NO matches in 2017.11.30 Project Sonar data set-->
1404
+ <fingerprint pattern="^([^ ]+) Sendmail ([^;]+); ([^;\.]+)$">
1405
+ <description>Sendmail - unknown platform, variant 1</description>
1406
+ <param pos="0" name="service.family" value="Sendmail"/>
1407
+ <param pos="0" name="service.product" value="Sendmail"/>
1408
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1409
+ <param pos="1" name="host.name"/>
1410
+ <param pos="2" name="service.version"/>
1411
+ <param pos="3" name="system.time"/>
1412
+ </fingerprint>
1413
+ <fingerprint pattern="^Sendmail ([^/]+)/([^/]+) ready on ([^ ]+)$">
1414
+ <description>Sendmail - basic with version and date</description>
1415
+ <param pos="0" name="service.family" value="Sendmail"/>
1416
+ <param pos="0" name="service.product" value="Sendmail"/>
1417
+ <param pos="1" name="service.version"/>
1418
+ <param pos="2" name="sendmail.config.version"/>
1419
+ <param pos="3" name="host.name"/>
1420
+ </fingerprint>
1421
+ <fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.(\d\.[\w.]+)\)$">
1422
+ <description>Sun Internet Mail Server</description>
1423
+ <example host.name="foo.bar" service.version="4.0.2000.10.12.16.25.p8">foo.bar -- Server ESMTP (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8)</example>
1424
+ <param pos="0" name="service.vendor" value="Sun"/>
1425
+ <param pos="0" name="service.family" value="Internet Mail Server"/>
1426
+ <param pos="0" name="service.product" value="Internet Mail Server"/>
1427
+ <param pos="0" name="os.vendor" value="Sun"/>
1428
+ <param pos="0" name="os.family" value="Solaris"/>
1429
+ <param pos="0" name="os.product" value="Solaris"/>
1430
+ <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
1431
+ <param pos="1" name="host.name"/>
1432
+ <param pos="2" name="service.version"/>
1433
+ </fingerprint>
1434
+ <fingerprint pattern="^(?:2.0.0 )?([^ ]+) ESMTP ecelerity (\d\.[\d.]+) r\(([^)]+)\) (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
1435
+ <description>Ecelerity</description>
1436
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:11:00 -0500">2.0.0 foo.bar ESMTP ecelerity 4.0.0.43760 r(Platform:4.0.0.1) Thu, 30 Nov 2017 05:11:00 -0500</example>
1437
+ <example>foo.bar ESMTP ecelerity 3.3.1.44388 r(44388) Thu, 30 Nov 2017 03:10:11 -0700</example>
1438
+ <example>foo.bar ESMTP ecelerity 3.6.25.56547 r(Core:3.6.25.0) Thu, 30 Nov 2017 03:17:07 -0600</example>
1439
+ <example service.version="4.2.37.61980" service.component.version=":">foo.bar ESMTP ecelerity 4.2.37.61980 r(:) Thu, 30 Nov 2017 09:58:54 +0000</example>
1440
+ <param pos="0" name="service.vendor" value="Ecelerity"/>
1441
+ <param pos="0" name="service.family" value="Ecelerity Mail Server"/>
1442
+ <param pos="0" name="service.product" value="Ecelerity Mail Server"/>
1443
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1444
+ <param pos="1" name="host.name"/>
1445
+ <param pos="2" name="service.version"/>
1446
+ <param pos="3" name="service.component.version"/>
1447
+ <param pos="4" name="system.time"/>
1448
+ </fingerprint>
1449
+ <fingerprint pattern="^(?i)([^ ]+) SMTP Server SLMail v?(\d\.[\d.]+) Ready ESMTP spoken here *$">
1450
+ <description>Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)</description>
1451
+ <example service.version="2.7">foo.bar Smtp Server SLMail v2.7 Ready ESMTP spoken here</example>
1452
+ <example service.version="3.2.3113">foo.bar SMTP Server SLmail 3.2.3113 Ready ESMTP spoken here</example>
1453
+ <example service.version="5.5.0.4433">foo.bar SMTP Server SLmail 5.5.0.4433 Ready ESMTP spoken here</example>
1454
+ <param pos="0" name="service.vendor" value="Seattle Labs"/>
1455
+ <param pos="0" name="service.family" value="SLMail"/>
1456
+ <param pos="0" name="service.product" value="SLMail"/>
1457
+ <param pos="1" name="host.name"/>
1458
+ <param pos="2" name="service.version"/>
1459
+ </fingerprint>
1460
+ <fingerprint pattern="^([^ ]+) +ESMTP Symantec Mail Security$">
1461
+ <description>Symantec Mail Security for SMTP</description>
1462
+ <example host.name="foo.bar">foo.bar ESMTP Symantec Mail Security</example>
1463
+ <param pos="0" name="service.vendor" value="Symantec"/>
1464
+ <param pos="0" name="service.product" value="Symantec Mail Security for SMTP"/>
1465
+ <param pos="1" name="host.name"/>
1466
+ </fingerprint>
1467
+ <fingerprint pattern="^([^ ]+) ESMTP Symantec Messaging Gateway$">
1468
+ <description>Symantec Mail Gateway</description>
1469
+ <example host.name="foo.bar">foo.bar ESMTP Symantec Messaging Gateway</example>
1470
+ <param pos="0" name="service.vendor" value="Symantec"/>
1471
+ <param pos="0" name="service.product" value="Symantec Messaging Gateway"/>
1472
+ <param pos="1" name="host.name"/>
1473
+ </fingerprint>
1474
+ <!-- SonicWall makes hardware, virtual appliances, and Windows software. The banner doesn't indicate which. -->
1475
+ <fingerprint pattern="^(?i)([^ ]+) ESMTP SonicWALL \(([\d.]+)\)$">
1476
+ <description>SonicWall Email Security</description>
1477
+ <example host.name="foo.bar" service.version="9.0.5.2077">foo.bar ESMTP SonicWALL (9.0.5.2077)</example>
1478
+ <example host.name="foo.bar" service.version="9.1.1.3113">foo.bar ESMTP SonicWall (9.1.1.3113)</example>
1479
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1480
+ <param pos="0" name="service.family" value="Email Security"/>
1481
+ <param pos="0" name="service.product" value="Email Security"/>
1482
+ <param pos="1" name="host.name"/>
1483
+ <param pos="2" name="service.version"/>
1484
+ </fingerprint>
1485
+ <fingerprint pattern="^([^ ]+) \(PowerMTA\(TM\) v([\d.r]+)\) ESMTP service ready$">
1486
+ <description>PowerMTA</description>
1487
+ <example host.name="foo.bar" service.version="3.2r24">foo.bar (PowerMTA(TM) v3.2r24) ESMTP service ready</example>
1488
+ <param pos="0" name="service.vendor" value="port25"/>
1489
+ <param pos="0" name="service.family" value="PowerMTA"/>
1490
+ <param pos="0" name="service.product" value="PowerMTA"/>
1491
+ <param pos="1" name="host.name"/>
1492
+ <param pos="2" name="service.version"/>
1493
+ </fingerprint>
1494
+ <fingerprint pattern="^([^ ]+) +VOPmail ESMTP Receiver Version (\d\.[\d.]+) Ready$">
1495
+ <description>VOPMail http://www.vircom.com/en/products/vopmail/vopmail.shtml</description>
1496
+ <example host.name="foo.bar" service.version="4.0.179.0">foo.bar VOPmail ESMTP Receiver Version 4.0.179.0 Ready</example>
1497
+ <param pos="0" name="service.vendor" value="Vircom"/>
1498
+ <param pos="0" name="service.family" value="VOPMail"/>
1499
+ <param pos="0" name="service.product" value="VOPMail"/>
1500
+ <param pos="1" name="host.name"/>
1501
+ <param pos="2" name="service.version"/>
1502
+ </fingerprint>
1503
+ <fingerprint pattern="^([^ ]+) VPOP3 E?SMTP Server (?:Ready|access not allowed!)$">
1504
+ <description>VPOP3 Email server: http://www.pscs.co.uk/products/vpop3/index.html</description>
1505
+ <example>foo.bar VPOP3 ESMTP Server Ready</example>
1506
+ <example>foo.bar VPOP3 SMTP Server Ready</example>
1507
+ <example>foo.bar VPOP3 SMTP Server access not allowed!</example>
1508
+ <param pos="0" name="service.vendor" value="Paul Smith Computer Services"/>
1509
+ <param pos="0" name="service.family" value="VPOP3"/>
1510
+ <param pos="0" name="service.product" value="VPOP3"/>
1511
+ <param pos="1" name="host.name"/>
1512
+ </fingerprint>
1513
+ <fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) (:?[^ ]+)? ?Network Associates.*Ready at (.+) *$">
1514
+ <description>McAfee WebShield</description>
1515
+ <example host.name="foo.bar" service.version="4.5" service.version.version="MR1a">foo.bar WebShield SMTP V4.5 MR1a Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1516
+ <example host.name="foo.bar" service.version="4.5" system.time="Thu Nov 30 09:15:32 2017">foo.bar WebShield SMTP V4.5 Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1517
+ <param pos="0" name="service.vendor" value="McAfee"/>
1518
+ <param pos="0" name="service.family" value="WebShield"/>
1519
+ <param pos="0" name="service.product" value="WebShield"/>
1520
+ <param pos="0" name="system.time.format" value="EEE d MMM HH:mm:ss yyyy"/>
1521
+ <param pos="1" name="host.name"/>
1522
+ <param pos="2" name="service.version"/>
1523
+ <param pos="3" name="service.version.version"/>
1524
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1525
+ <param pos="4" name="system.time"/>
1526
+ </fingerprint>
1527
+ <fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
1528
+ <description>McAfee Webshield ASaP (bundled hardware / software)</description>
1529
+ <example host.name="foo.bar" service.version="1.0.1" system.time="Sun, 29 Jul 2001 22:46:18 -0700">foo.bar McAfee WebShield ASaP v1.0.1: Sun, 29 Jul 2001 22:46:18 -0700</example>
1530
+ <param pos="0" name="service.vendor" value="McAfee"/>
1531
+ <param pos="0" name="service.family" value="WebShield"/>
1532
+ <param pos="0" name="service.product" value="WebShield"/>
1533
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1534
+ <param pos="0" name="os.vendor" value="McAfee"/>
1535
+ <param pos="0" name="os.family" value="Linux"/>
1536
+ <param pos="0" name="os.product" value="Linux"/>
1537
+ <param pos="1" name="host.name"/>
1538
+ <param pos="2" name="service.version"/>
1539
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1540
+ <param pos="3" name="system.time"/>
1541
+ </fingerprint>
1542
+ <fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
1543
+ <description>McAfee VirusScreen</description>
1544
+ <example host.name="foo.bar" service.version="1.1" system.time="Sun, 20 Jul 2003 09:20:52 -0700">foo.bar McAfee VirusScreen ASaP v1.1: Sun, 20 Jul 2003 09:20:52 -0700</example>
1545
+ <param pos="0" name="service.vendor" value="McAfee"/>
1546
+ <param pos="0" name="service.family" value="WebShield"/>
1547
+ <param pos="0" name="service.product" value="WebShield"/>
1548
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1549
+ <param pos="0" name="os.vendor" value="McAfee"/>
1550
+ <param pos="0" name="os.family" value="Linux"/>
1551
+ <param pos="0" name="os.product" value="Linux"/>
1552
+ <param pos="1" name="host.name"/>
1553
+ <param pos="2" name="service.version"/>
1554
+ <param pos="0" name="service.cpe23" value="cpe:/a:mcafee:webshield:{service.version}"/>
1555
+ <param pos="3" name="system.time"/>
1556
+ </fingerprint>
1557
+ <fingerprint pattern="^([^ ]+) ESMTP Lyris ListManager service ready$">
1558
+ <description>Lyris ListManager</description>
1559
+ <example host.name="foo.bar">foo.bar ESMTP Lyris ListManager service ready</example>
1560
+ <param pos="0" name="service.vendor" value="Lyris"/>
1561
+ <param pos="0" name="service.family" value="ListManager"/>
1562
+ <param pos="0" name="service.product" value="ListManager"/>
1563
+ <param pos="1" name="host.name"/>
1564
+ </fingerprint>
1565
+ <fingerprint pattern="^([^ ]+) ESMTP - WinRoute Pro ([^ ]+\.[^ ]+)$">
1566
+ <description>WinRoute Pro, runs on 9x/NT/2k http://www.tinysoftware.com/winpro.php</description>
1567
+ <example host.name="foo.bar" service.version="4.2.4">foo.bar ESMTP - WinRoute Pro 4.2.4</example>
1568
+ <param pos="0" name="service.family" value="WinRoute"/>
1569
+ <param pos="0" name="service.product" value="WinRoute"/>
1570
+ <param pos="1" name="host.name"/>
1571
+ <param pos="2" name="service.version"/>
1572
+ </fingerprint>
1573
+ <fingerprint pattern="^ESMTP - WinRoute Pro ([^ ]+\.[^ ]+) *(?: #\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)$">
1574
+ <description>WinRoute Pro w/o hostname</description>
1575
+ <example service.version="4.2.1">ESMTP - WinRoute Pro 4.2.1 Thu, 16 Nov 2017 11:48:15 +0300</example>
1576
+ <param pos="0" name="service.family" value="WinRoute"/>
1577
+ <param pos="0" name="service.product" value="WinRoute"/>
1578
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss Z"/>
1579
+ <param pos="1" name="service.version"/>
1580
+ <param pos="2" name="system.time"/>
1581
+ </fingerprint>
1582
+ <fingerprint pattern="^([^ ]+) ZMailer Server (\d\.[\d.]+) #([^ ]+) ESMTP ready at (.+) *$">
1583
+ <description>ZMailer http://www.zmailer.org/technical.html</description>
1584
+ <example service.version="2.99.57" service.version.version="1">foo.bar ZMailer Server 2.99.57 #1 ESMTP ready at Thu, 16 Nov 2017 12:00:12 +0300</example>
1585
+ <param pos="0" name="service.vendor" value="ZMailer"/>
1586
+ <param pos="0" name="service.family" value="ZMailer"/>
1587
+ <param pos="0" name="service.product" value="ZMailer"/>
1588
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1589
+ <param pos="1" name="host.name"/>
1590
+ <param pos="2" name="service.version"/>
1591
+ <param pos="3" name="service.version.version"/>
1592
+ <param pos="4" name="system.time"/>
1593
+ </fingerprint>
1594
+ <fingerprint pattern="^([^ ]+) ZMailer Server (\d\.[\d.]+) #([^ ]+) ESMTP\+IDENT ready at (.+) *$">
1595
+ <description>ZMailer server that supports IDENT</description>
1596
+ <example service.version="2.99.55" service.version.version="16">foo.bar ZMailer Server 2.99.55 #16 ESMTP+IDENT ready at Thu, 16 Nov 2017 06:51:42 -0300</example>
1597
+ <param pos="0" name="service.vendor" value="ZMailer"/>
1598
+ <param pos="0" name="service.family" value="ZMailer"/>
1599
+ <param pos="0" name="service.product" value="ZMailer"/>
1600
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1601
+ <param pos="0" name="zmailer.ident" value="yes"/>
1602
+ <param pos="1" name="host.name"/>
1603
+ <param pos="2" name="service.version"/>
1604
+ <param pos="3" name="service.version.version"/>
1605
+ <param pos="4" name="system.time"/>
1606
+ </fingerprint>
1607
+ <fingerprint pattern="^([^ ]+) Kerio Connect (\d\.[\d.]+) (?:patch (\d) )?ESMTP ready$">
1608
+ <description>Kerio Connect ESMTP</description>
1609
+ <example host.name="foo.bar" service.version="8.0.2">foo.bar Kerio Connect 8.0.2 ESMTP ready</example>
1610
+ <example service.version="9.2.5" service.version.version="3">foo.bar Kerio Connect 9.2.5 patch 3 ESMTP ready</example>
1611
+ <param pos="0" name="service.vendor" value="Kerio"/>
1612
+ <param pos="0" name="service.family" value="Connect"/>
1613
+ <param pos="0" name="service.product" value="ESMTP"/>
1614
+ <param pos="1" name="host.name"/>
1615
+ <param pos="2" name="service.version"/>
1616
+ <param pos="3" name="service.version.version"/>
1617
+ </fingerprint>
1618
+ <fingerprint pattern="^([^ ]+) ESMTP CommuniGate Pro (\d\.[\w.]+)(?:. It is you again :-\()?$">
1619
+ <description>Communigate Pro</description>
1620
+ <example host.name="foo.bar" service.version="5.3.1">foo.bar ESMTP CommuniGate Pro 5.3.1</example>
1621
+ <example host.name="foo.bar" service.version="6.2c3">foo.bar ESMTP CommuniGate Pro 6.2c3</example>
1622
+ <example host.name="foo.bar" service.version="4.3.12">foo.bar ESMTP CommuniGate Pro 4.3.12. It is you again :-(</example>
1623
+ <param pos="0" name="service.vendor" value="Communigater"/>
1624
+ <param pos="0" name="service.family" value="Pro"/>
1625
+ <param pos="0" name="service.product" value="ESMTP"/>
1626
+ <param pos="1" name="host.name"/>
1627
+ <param pos="2" name="service.version"/>
1628
+ </fingerprint>
1629
+ <fingerprint pattern="^(\S+) NO UCE NO UBE NO RELAY PROBES ESMTP">
1630
+ <description>Twisted SMTP server</description>
1631
+ <example host.name="foo.bar">foo.bar NO UCE NO UBE NO RELAY PROBES ESMTP</example>
1632
+ <param pos="0" name="service.vendor" value="Twisted Matrix Labs"/>
1633
+ <param pos="0" name="service.family" value="Twisted"/>
1634
+ <param pos="0" name="service.product" value="ESMTP"/>
1635
+ <param pos="1" name="host.name"/>
1636
+ </fingerprint>
1637
+ <fingerprint pattern="^Cellopoint E-mail Firewall v(\d\.[\d.]+) Build (\d+) ready$">
1638
+ <description>Cellopoint E-mail Firewall</description>
1639
+ <example service.version="3.9.12" service.version.version="0324">Cellopoint E-mail Firewall v3.9.12 Build 0324 ready</example>
1640
+ <param pos="0" name="service.vendor" value="Cellopoint"/>
1641
+ <param pos="0" name="service.family" value="UTM"/>
1642
+ <param pos="0" name="service.product" value="E-mail Firewall"/>
1643
+ <param pos="1" name="service.version"/>
1644
+ <param pos="2" name="service.version.version"/>
1645
+ </fingerprint>
1646
+ <fingerprint pattern="^ESMTP on WinWebMail \[(\d\.[\d.]+)\] ready\. http://www.winwebmail.com$">
1647
+ <description>Ma Jian WinWebMail</description>
1648
+ <example service.version="3.9.0.7">ESMTP on WinWebMail [3.9.0.7] ready. http://www.winwebmail.com</example>
1649
+ <param pos="0" name="service.vendor" value="Ma Jian"/>
1650
+ <param pos="0" name="service.family" value="WinWebMail"/>
1651
+ <param pos="0" name="service.product" value="ESMTP"/>
1652
+ <param pos="1" name="service.version"/>
1653
+ </fingerprint>
1654
+ <fingerprint pattern="^([^ ]+) Service ready by David.fx \((\d+)\) ESMTP Server \(Tobit.Software, Germany\)$">
1655
+ <description>Tobit Software David</description>
1656
+ <example service.version="0486">foo.bar Service ready by David.fx (0486) ESMTP Server (Tobit.Software, Germany)</example>
1657
+ <param pos="0" name="service.vendor" value="Tobit Software"/>
1658
+ <param pos="0" name="service.family" value="David"/>
1659
+ <param pos="0" name="service.product" value="ESMTP"/>
1660
+ <param pos="1" name="host.name"/>
1661
+ <param pos="2" name="service.version"/>
1662
+ </fingerprint>
1663
+ <fingerprint pattern="^(?i)(\S+) E?SMTP Perl">
1664
+ <description>Some simple PERL SMTP server</description>
1665
+ <example host.name="foo.bar">foo.bar ESMTP Perl</example>
1666
+ <param pos="0" name="service.product" value="Perl"/>
1667
+ <param pos="1" name="host.name"/>
1668
+ </fingerprint>
1669
+ <fingerprint pattern="^(?i)(?:([^ ]+) )?E?SMTP(?: (?:Service )?Ready\.?)?$">
1670
+ <description>Non-specific banner with optional hostname</description>
1671
+ <example host.name="foo.bar">foo.bar ESMTP</example>
1672
+ <example host.name="foo.bar">foo.bar ESMTP Ready</example>
1673
+ <example host.name="foo.bar">foo.bar SMTP</example>
1674
+ <example host.name="foo.bar">foo.bar ESMTP Service ready</example>
1675
+ <example>ESMTP ready</example>
1676
+ <example>SMTP Ready</example>
1677
+ <example>ESMTP READY</example>
1678
+ <param pos="1" name="host.name"/>
1679
+ </fingerprint>
1680
+ <fingerprint pattern="^([^ ]+) ESMTP OpenSMTPD$">
1681
+ <description>OpenSMPTD</description>
1682
+ <example host.name="foo.bar">foo.bar ESMTP OpenSMTPD</example>
1683
+ <param pos="0" name="service.vendor" value="OpenBSD"/>
1684
+ <param pos="0" name="service.family" value="OpenSMTPD"/>
1685
+ <param pos="0" name="service.product" value="OpenSMTPD"/>
1686
+ <param pos="0" name="os.cpe23" value="cpe:/o:openbsd:openbsd:-"/>
1687
+ <param pos="0" name="service.cpe23" value="cpe:/a:openbsd:opensmtpd:-"/>
1688
+ <param pos="1" name="host.name"/>
1689
+ </fingerprint>
1690
+ </fingerprints>