Common attacks and weaknesses
- Passwords sent in clear text.
- Brute force against mailboxes.
Port 110: POP3
Mailbox download protocol. Clear text unless STARTTLS is used.
110
How POP3 works
EmailThe mail client connects to port 110 to download or sync the messages waiting in the mailbox. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
Is port 110 dangerous?
How to secure it
- Use POP3S (995) or disable POP3 entirely.
- Enforce MFA or app passwords.
IANA registry entries for port 110
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| pop3 | 110 | TCP, UDP | Post Office Protocol - Version 3 | - | - |
// source: IANA service name and port number registry
Which program uses port 110, and is it reachable?
Linux
sudo ss -ltnup 'sport = :110' # process listening on 110
sudo lsof -nP -i :110macOS
sudo lsof -nP -i :110
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 110 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 110 netstat -ano | findstr :110
From another machine
nmap -p 110 -sV <host> sudo nmap -sU -p 110 <host> nc -zv <host> 110
Block it in the firewall
sudo ufw deny 110/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 110" -Direction Inbound -LocalPort 110 -Protocol TCP -Action Block # Windows
What is port 110 used for?
Mailbox download protocol. Clear text unless STARTTLS is used.
Is port 110 TCP or UDP?
Port 110 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 110?
It is rated 6/10 (high) when exposed to the Internet. Passwords sent in clear text. Use POP3S (995) or disable POP3 entirely.
How do I check if port 110 is open?
On Linux run "ss -ltnup 'sport = :110'", on macOS "lsof -nP -i :110", and on Windows "netstat -ano | findstr :110" to see the local process. From another machine, "nmap -p 110 <host>" shows whether it is reachable.