ZoomEye can show which internet-facing hosts respond with mail-related services and banners, which makes it a practical starting point for studying exposed email security gateways. A ZoomEye match, however, does not tell you that a host is an email gateway, which vendor operates it, or whether it is misconfigured. Each match is an observation that needs corroboration before it supports any conclusion. The sources reviewed for this article establish a multi-signal method for identifying mail-delivery services. They do not establish a validated ZoomEye query for email gateways or a current count of exposed devices.
What ZoomEye documents about its search
ZoomEye’s API v2 documentation, last updated 2024-12-04, describes search across IPv4 and IPv6 devices and across websites and domains. Matching can span content from protocols such as HTTP, SSH, and FTP, including service banners. The guide documents filters for the following fields:
- IP and CIDR range
- Organization and ASN
- Port, transport protocol, and service
- Hostname and domain
- Banner, device, and product
- Geography and time
The documentation also describes operators for exact matching, conjunction, disjunction, exclusion, and grouping. This article does not reproduce query syntax. Take the current operator forms from the API v2 documentation at the time you run any query, because a query copied from an older example may return different results.
These are general asset-search features. The documentation describes how fields can be searched; it does not present an email-gateway classifier or a tested recipe that isolates gateways.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall
As an Amazon Associate I earn from qualifying purchases.
What a search match establishes
A ZoomEye result records that a service answered in a specific dataset at a specific time. It is useful evidence of an internet-facing observation. It is weaker evidence of what the service is.
- It does not prove the product. A banner can be generic, reused by other software, or changed by a configuration layer, so a matching string is not a product identification on its own.
- It does not prove the operator. An IP address or domain in a result may belong to a hosting provider, a managed service, or a customer, and the search record does not settle which.
- It does not prove the security posture. Whether a service is misconfigured or vulnerable requires separate evidence and testing within authorization.
- It can be stale or incomplete. Search-engine records reflect past scans. The 2025 NDSS paper Revealing the Black Box of Device Search Engines examines device search engine behavior, including SMTP, and supports caution about treating indexed records as ground truth.
Corroborating a candidate with independent signals
The 2024 study Unfiltered: Measuring Cloud-based Email Filtering Bypasses identifies organizations that accept mail delivery by combining several signals rather than relying on one. Each signal answers a different question, and none is decisive alone.
#1 Best Overall
- Fortinet FortiMail-VM virtual appliance for all supported platforms. 8 x vCPU cores
- Fortinet SW FML-VM08
- Manufacturer Part: FML-VM08
MX and A records
MX records show which hosts a domain names as mail exchangers, and A records map those names to IP addresses. Comparing them with a ZoomEye candidate tests whether the observed address is actually in the mail path for a domain you are assessing. A match with no MX relationship suggests the host may be unrelated to mail delivery for that domain, although it may still run a mail service for other reasons.
TLS certificates
TLS certificates presented on SMTP connections can carry names that connect a host to a provider or to the domain being assessed. They are a useful cross-check, but certificate names can be shared across infrastructure, so a certificate match supports a candidate rather than proving it.
Rank #2
- Watchguard T145 Firebox with 3 Year Basic Security Suite License (WGT145033) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
SMTP banners
The SMTP greeting banner is the signal most often matched in search data, which is why it needs the most care. A banner naming a product is evidence that the product string was presented. It should be compared against the other signals before a host is labeled as a gateway.
Protocol responses
Responses to standard SMTP commands and other protocol behavior can show how a service handles mail, which is closer to direct observation than a stored banner. Protocol testing must stay within the scope you are authorized to assess.
| Signal | What it can help establish | What it cannot establish alone |
|---|---|---|
| ZoomEye field match (banner, service, port) | A service was recorded at an address at a time | Product identity, operator, or security posture |
| MX and A records | Whether an address sits in a domain’s mail path | Which product handles the mail, or whether it is a gateway |
| TLS certificate on SMTP | Names linking a host to a provider or domain | Exclusive ownership, since certificates can be shared |
| SMTP banner | A product string presented by the service | Confirmed product, because banners can be generic or altered |
| Protocol responses | How the service handles mail commands | Vulnerability or misconfiguration without separate assessment |
The provider set in the 2024 study
The study reports signatures for 15 leading email filtering services. It lists them as Proofpoint, Mimecast, Cisco (aka Ironport), Barracuda, TrendMicro, Broadcom (formerly Symantec), Trellix (formerly FireEye), Sophos, Cloudflare, Fortinet, N-able (formerly SolarWinds MSP), Forcepoint, AppRiver, Spamhero, and HornetSecurity.
Use this list as the study’s own example of vendor diversity. It is not a current market directory, and it is not an exhaustive list of products that appear as exposed gateways. Vendor names change through acquisitions and renaming, and the study itself lists several under former names.
A validation sequence for candidate gateways
The steps below describe a classification workflow built from the signals above. They are a method for structuring the work, not a tested procedure reported by the sources.
- Define authorized scope. List the IP addresses, domains, and keywords you are permitted to assess, such as those in your own asset inventory. ZoomEye’s attack-surface-management product page describes its workflow as starting from customer-supplied asset leads, including IP addresses, domains, and keywords, followed by ongoing discovery and monitoring. That is the vendor’s description of its product, not a legal determination for your situation.
- Record the query and observation. Save the exact query text, the ZoomEye data type searched (IPv4, IPv6, or website/domain), the filters applied, and the date of observation. Without these, the result cannot be repeated.
- Label results as candidates. Every match starts as an unvalidated observation, not a finding.
- Check MX and A relationships. Confirm whether the candidate address is connected to the mail path of the domain under assessment.
- Check certificates and banners. Compare TLS names and SMTP banners against each other. A candidate that agrees on both is stronger than one that matches a banner alone.
- Test protocol behavior within scope. Use direct SMTP responses to confirm how the service handles mail.
- Assign a confidence level. Classify each host as candidate, corroborated, or confirmed, and state which signals support that level.
- Re-observe over time. Repeat the query on a later date and note changes. A single snapshot shows one moment, not a stable state.
Comparing measurement approaches
The table compares approaches on the axes that matter for interpreting results. The sources establish these axes, but they do not benchmark ZoomEye against other products, so cells marked “not stated” reflect that gap rather than a judgment about performance.
Rank #4
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
| Approach | Signal type | Confidence from one observation | Scope and authorization | Reproducibility |
|---|---|---|---|---|
| Asset-search query only | Indexed fields such as banner, port, service | Low; a single banner is not definitive | General internet observation unless limited to authorized assets | Depends on recorded query, filters, and date |
| Query plus DNS and certificate checks | Asset search combined with MX, A, and TLS evidence | Moderate; signals can be independent but may still share infrastructure | Limited to the domains and addresses assessed | Reproducible if records and dates are kept |
| Direct SMTP protocol evidence | Live responses to mail commands | Higher for mail behavior; product identity still needs corroboration | Must stay within authorization | Depends on timing and the service’s state at test time |
| Head-to-head comparison with other search products | Not stated in the sources | Not stated in the sources | Not stated in the sources | Not stated in the sources |
What the evidence does not support
- A count or trend of exposed gateways. No current result count was established for ZoomEye, and this article reports none.
- A validated ZoomEye query for email gateways. The documentation describes filters and operators. It does not show that any query uniquely identifies gateways.
- Vendor attribution from a banner alone. A product string in a result is a candidate signal, not proof of the operator.
- Geographic or date-range conclusions. The sources do not specify a geography or period for any measurement, so none can be drawn from them.
Any future measurement study built on this method should state its query, data type, filters, observation date, authorization basis, and validation steps so that a reader can judge the result.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
- Watchguard T125 Firebox with 5 Year Basic Security Suite License (WGT125035) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
