Port 110 (POP3) is targeted by password-spraying, brute-force attacks, and interception of credentials when plain POP3 is used. Attackers may also probe mail services for weak authentication or exposed legacy access. Defenders should require encrypted POP3 variants where needed, disable unused access, and watch for repeated authentication failures and unusual mailbox retrieval patterns.
How attackers use Port 110 as an authentication target
POP3 on port 110 is usually attacked because it exposes a simple, predictable login path. Password-spraying and brute-force attempts are common when mailbox access is reachable over the internet, and plain POP3 can also leak credentials in transit. The practical security issue is less about the port number itself than about whether authentication is exposed without strong transport protection and rate limiting.
Legacy mail access often survives longer than teams expect, which makes it a useful foothold for repeated login attempts against old or poorly monitored accounts. For a broader view of how open protocols and exposed service ports are typically hardened, see the Network Ports and Protocols Security Guide.
What makes POP3 exposure risky in practice
The main risk is that POP3 can turn mailbox access into a credential attack surface. If the service allows weak passwords, lacks throttling, or still permits cleartext sessions, an attacker can test credentials at scale or intercept them on the wire. Even when the protocol is functioning as intended, repeated retrieval attempts can generate noisy but easy-to-miss signals if mail authentication logs are not being reviewed.
Attackers also benefit from the fact that mailboxes are often trusted infrastructure. A successful POP3 login can reveal stored messages, password reset links, or internal communications that support follow-on compromise. In environments where mail access is tied to older workflows, the path from one mailbox to broader account takeover can be shorter than teams assume.
How to reduce POP3 attack exposure
The best control is to remove unnecessary POP3 exposure altogether. If legacy access is still required, enforce encrypted POP3 variants, restrict which hosts can reach the service, and ensure authentication is covered by modern monitoring. Weak or unused mail access should be disabled rather than left available as a fallback.
When investigating whether POP3 is still needed, treat it as a service inventory question as well as a security question. If the protocol remains in use, the identity and access model must be tight enough that repeated failures, unusual mailbox access times, and geographically implausible login patterns become visible quickly. For protocol ownership and registry context, IANA is the authoritative source for port and protocol assignments.
Risk and Threat Considerations
Port 110 becomes materially risky when legacy mail retrieval is reachable from untrusted networks, because attackers can combine credential guessing with passive credential interception if cleartext POP3 is still enabled. The consequence is not just mailbox access, but potential exposure of sensitive correspondence and account recovery workflows.
Failure mechanism: Weak authentication controls, reused passwords, and unencrypted sessions let attackers either guess credentials at scale or capture them during transit, then reuse the mailbox as a trusted access point.
Impact: Successful compromise can expose email content, reset links, and internal business communications, and it may support broader account takeover if the mailbox is used for recovery or alerting.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | POP3 attacks hinge on password guessing and credential handling. |
| SC-8 — Transmission Confidentiality and Integrity | Plain POP3 can expose credentials in transit and needs protected channels. | |
| Recommendation — Enforce credential lifecycle controls and rotate or revoke weak mailbox authenticators. Require protected transport for mailbox authentication and retrieval traffic. | ||
| CIS Controls v8 | CIS-5 — Account Management | POP3 exposure is reduced by disabling unnecessary accounts and access paths. |
| Recommendation — Disable unused mail access paths and remove stale accounts that still accept POP3 logins. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Mailbox access often depends on credentials that remain valid too long. |
| Recommendation — Shorten credential lifetime for mail access and eliminate long-lived reusable secrets. | ||
| MITRE ATT&CK | T1110 — Brute Force | Password-spraying and brute-force attempts are core attack patterns against POP3. |
| Recommendation — Detect and rate-limit repeated authentication attempts against mail services. | ||
Practitioner Guidance
What to verify: Confirm whether POP3 is still required, whether encryption is mandatory for every client path, and whether login throttling or lockout controls are actually enforced. A service that is “enabled but rarely used” is still an attack surface if it accepts internet-facing authentication.
What to measure: Watch for failed authentication bursts, repeated attempts against the same usernames, and mailbox access patterns that do not match normal user behaviour. A sudden shift from low-volume mail retrieval to repeated short-interval sessions is a useful warning signal.
Practitioner takeaway: Treat POP3 on port 110 as a legacy authentication surface, not just a mail protocol, and prioritise exposure reduction before relying on detection alone.