EmailTCP 110, 995 Cleartext by default
Port 110, 995: POP3
Post Office Protocol v3
Downloads email from a server to a client. Port 110 is cleartext; 995 is POP3 over TLS.
Secure alternative: POP3S (995)
How attackers abuse it
- Credentials and mail readable on 110.
- Password guessing against mailboxes.
How to defend it
- Disable 110 and allow only 995.
- Use modern authentication and MFA where supported.
Exam tip
Secure email retrieval ports: 995 (POP3S) and 993 (IMAPS).