What it detects
Session proceeding without the server greeting (220).
Why it fires
Possible non-standard client, probing or open-relay discovery.
Worst case
Mail-server probing
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.