logo

Port 110 – POP3 (Post Office Protocol version 3)

Service:

pop3

Protocol:

TCP

Port:

110

Used for:

Used for retrieving email messages from mail servers to local email clients

Why It’s Open

Port 110 is the standard port for Post Office Protocol version 3 (POP3), a legacy protocol for email retrieval. While modern systems typically use IMAP with encryption, POP3 remains supported for backward compatibility with older email clients. Mail servers expose this port to allow message downloading, though encrypted POP3S (port 995) is now preferred.

Common Risks

  • Clear‑text Transmission
    Credentials and email content sent unencrypted
  • Password Attacks
    Vulnerable to brute force and credential stuffing
  • Data Exposure
    Compromised accounts reveal stored messages
  • Legacy Vulnerabilities
    Older implementations may contain unpatched flaws
  • Software Disclosure
    Server banners expose version information

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Check if it’s open:

Terminal window
nmap -sT -p 110

Test POP3 connection:

Terminal window
telnet  110

Basic authentication test:

Terminal window
nc  110

What to Look For

CheckpointWhat it means
Unencrypted POP3Authentication and data exposed
Visible version infoReveals software details
No login attempt limitsEnables brute force attacks
Missing STARTTLSNo encryption upgrade option

Mitigation

  • Migrate to POP3S
    Use encrypted port 995 exclusively
  • Require STARTTLS
    Enforce encryption when POP3 is necessary
  • Rate Limit Logins
    Block excessive authentication attempts
  • Modern Authentication
    Implement OAuth or SASL mechanisms
  • Network Restrictions
    Limit access to required IP ranges

TL;DR

  • Standard unencrypted POP3 port
  • Should be replaced with POP3S
  • High credential attack risk
  • Requires additional security controls

Known CVEs and Exploits