Internet-Security.com TCP port 110 details

TCP port 110 is used by the Post Office Protocol version 3 (POP3) to retrieve email from mail servers.
Common POP3 server software listening on 110 includes Dovecot, Courier-POP3, Cyrus (pop3d), UW ipop3d, and the legacy Qualcomm Qpopper.
Many hosting stacks (e.g., cPanel/WHM and Plesk) expose POP3 on 110 via Dovecot or Courier for customer mailboxes.
Enterprise products such as Microsoft Exchange Server (POP3 service), Zimbra Collaboration Suite, and hMailServer can provide POP3 on 110.
Email clients like Microsoft Outlook, Mozilla Thunderbird, and Apple Mail connect to these servers on 110, often upgrading to TLS via the STLS command.
POP3 fetchers and gateways such as fetchmail and getmail retrieve mail from remote servers over port 110.
While 995 (POP3S) is preferred today, port 110 remains enabled for STARTTLS-based POP3 on many networks and legacy systems.
Security note: Port 110 is a common target for POP3 credential brute-force attacks, and older daemons like Qpopper have had buffer-overflow vulnerabilities exploited in the wild.

TCP 110