nuclei-templates/dns/mx-service-detector.yaml

73 lines
1.8 KiB
YAML
Raw Normal View History

2020-11-11 22:21:13 +00:00
id: mx-service-detector
info:
name: E-mail service detector
author: binaryfigments
severity: info
description: Check the email service or spam filter that is used for a domain.
2021-02-12 06:19:06 +00:00
tags: dns
2020-11-11 22:21:13 +00:00
dns:
- name: "{{FQDN}}"
type: MX
class: inet
recursion: true
retries: 5
matchers-condition: or
matchers:
- type: word
name: "Office 365"
words:
- "mail.protection.outlook.com"
- type: word
name: "Google Apps"
words:
- "aspmx2.googlemail.com"
- "aspmx3.googlemail.com"
- "alt1.aspmx.l.google.com"
- "alt2.aspmx.l.google.com"
- "aspmx.l.google.com"
- type: word
name: "ProtonMail"
words:
- "mail.protonmail.ch"
- "mailsec.protonmail.ch"
- type: word
name: "Zoho Mail"
words:
- "mx.zoho.eu"
- "mx2.zoho.eu"
- "mx3.zoho.eu"
- type: word
2020-11-11 22:22:57 +00:00
name: "ForcePoint Email Security"
2020-11-11 22:21:13 +00:00
words:
- "in.mailcontrol.com"
- type: word
name: "E-Zorg NL"
words:
- "spamfilter02.ezorg.nl"
- "spamfilter01.ezorg.nl"
- "spamfilter.ezorg.nl"
- "spamfilter03.ezorg.nl"
- type: word
name: "Kerio Cloud EU"
words:
- "mx1.eu1.kerio.cloud"
- "mx2.eu1.kerio.cloud"
- type: word
name: "Kerio Cloud US"
words:
- "mx1.us1.kerio.cloud"
- "mx2.us1.kerio.cloud"
- "mx3.us1.kerio.cloud"
- type: word
name: "Proofpoint EU"
words:
- "mx1-eu1.ppe-hosted.com"
- "mx2-eu1.ppe-hosted.com"
- type: word
name: "Proofpoint US"
words:
- "mx1-us1.ppe-hosted.com"
- "mx2-us1.ppe-hosted.com"