<?xml version='1.0' encoding='UTF-8'?>
<fingerprints protocol="smtp" database_type="service" preference="0.15">
  <!--
  SMTP response lines to the VRFY command are matched against these patterns
  (1 line at a time) to fingerprint SMTP servers.
  See comment at the top of smtp_banners.xml for additional info.
  'preference' note: This value has been set so as to implement the ordering
    of SMTP related fingerprint databases as described in 'smtp_banners.xml'.
  -->

  <fingerprint pattern="^500[ -]Syntax error, command &quot;XXXX.*&quot; unrecognized$">
    <description>Cisco PIX - changes the command letters to 'X' before passing them to the real SMTP server</description>
    <param pos="0" name="os.vendor" value="Cisco"/>
    <param pos="0" name="os.family" value="PIX"/>
    <param pos="0" name="os.product" value="PIX"/>
    <param pos="0" name="os.cpe23" value="cpe:/o:cisco:pix_firewall_software:-"/>
  </fingerprint>

  <!-- XXX: Why is EXPN mentionned here ? Is this a mistake ? -->

  <fingerprint pattern="^550[ -]EXPN not available *$">
    <description>Exim - expn not available variant</description>
    <example>550 EXPN not available</example>
    <param pos="0" name="service.vendor" value="exim"/>
    <param pos="0" name="service.family" value="exim"/>
    <param pos="0" name="service.product" value="exim"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
  </fingerprint>

  <fingerprint pattern="^252[ -]VRFY not available *$">
    <description>Exim - vrfy not available variant</description>
    <example>252 VRFY not available</example>
    <param pos="0" name="service.vendor" value="exim"/>
    <param pos="0" name="service.family" value="exim"/>
    <param pos="0" name="service.product" value="exim"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
  </fingerprint>

  <fingerprint pattern="^250[ -]&lt;.+&gt; is deliverable *$">
    <description>Exim - vrfy variant</description>
    <example>250 &lt;root&gt; is deliverable</example>
    <param pos="0" name="service.vendor" value="exim"/>
    <param pos="0" name="service.family" value="exim"/>
    <param pos="0" name="service.product" value="exim"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
  </fingerprint>

  <fingerprint pattern="^550[ -]&lt;.+&gt; is not deliverable *$">
    <description>Exim - not deliverable variant</description>
    <example>550 &lt;root&gt; is not deliverable</example>
    <param pos="0" name="service.vendor" value="exim"/>
    <param pos="0" name="service.family" value="exim"/>
    <param pos="0" name="service.product" value="exim"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:exim:exim:-"/>
  </fingerprint>

  <fingerprint pattern="^502[ -]command is not active$">
    <description>Alt-N MDaemon - vrfy variant</description>
    <example>502 command is not active</example>
    <param pos="0" name="service.vendor" value="Alt-N"/>
    <param pos="0" name="service.family" value="MDaemon"/>
    <param pos="0" name="service.product" value="MDaemon"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:altn:mdaemon:-"/>
    <param pos="0" name="os.vendor" value="Microsoft"/>
    <param pos="0" name="os.family" value="Windows"/>
    <param pos="0" name="os.product" value="Windows"/>
    <param pos="0" name="os.arch" value="x86"/>
    <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
  </fingerprint>

  <fingerprint pattern="^557[ -]5\.5\.2 String does not match anything\. *$">
    <description>Gordano NTMail - seen this on NTMail 4.30.0012, NTMail 5.06.0016</description>
    <param pos="0" name="service.vendor" value="Gordano"/>
    <param pos="0" name="service.family" value="NTMail"/>
    <param pos="0" name="service.product" value="NTMail"/>
  </fingerprint>

  <fingerprint pattern="^252[ -](?:2\.5\.2)? Cannot VRFY user; try RCPT to attempt delivery \(or try finger\) *$">
    <description>Sendmail - vrfy variant</description>
    <param pos="0" name="service.family" value="Sendmail"/>
    <param pos="0" name="service.product" value="Sendmail"/>
    <param pos="0" name="service.certainty" value="0.85"/>
  </fingerprint>

  <fingerprint pattern="^504 .*: Recipient address rejected: need fully-qualified address$">
    <description>Symantec Mail Security</description>
    <example>504 &lt;foo&gt;: Recipient address rejected: need fully-qualified address</example>
    <param pos="0" name="service.vendor" value="Symantec"/>
    <param pos="0" name="service.product" value="Mail Security for SMTP"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:symantec:mail_security_for_smtp:-"/>
  </fingerprint>

  <fingerprint pattern="^252 Unable to VRFY &quot;.*&quot;, but will accept message and attempt delivery *$">
    <description>Lotus Domino - vrfy variant</description>
    <param pos="0" name="service.vendor" value="Lotus"/>
    <param pos="0" name="service.family" value="Lotus Domino"/>
    <param pos="0" name="service.product" value="Lotus Domino"/>
    <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
  </fingerprint>

</fingerprints>