TCP Port 995 – POP3S (POP3 over TLS)

Port 995 is the standard port for POP3S, the encrypted version of the Post Office Protocol version 3. When an email client retrieves messages from a mail server using POP3S, it connects to TCP port 995 and negotiates a TLS encrypted session before sending any credentials or message contents. The current specification for using TLS with POP3 retrieval is RFC 8314 (2018), which formalized implicit TLS as the recommended approach for mail submission and retrieval.

POP3S on port 995 is the encrypted alternative to plaintext POP3 on port 110. Like its IMAP counterpart on port 993, port 995 uses implicit TLS, where the encrypted session begins immediately on connection. POP3 with STARTTLS on port 110 is also possible but is considered less reliable, since a misconfigured client or server can fall back to plaintext. Common practice today is to disable port 110 entirely on internet-facing mail servers and offer only POP3S on port 995 to clients.

POP3S itself sees less use than IMAPS in modern email environments, since IMAP’s synchronized server-side mailbox model fits the way most people use email today. Users who specifically want messages downloaded to a single device, or who manage email through a client that does not support IMAP, still rely on POP3S for encrypted retrieval. Most major mail providers continue to offer it for compatibility.

Port 995 is also defined for UDP in the IANA registry, with the historical service name “spop3” preserved alongside “pop3s.” UDP/995 is not used in practice.

About TCP Port 995

Port 995 carries the IANA assignment for pop3s. The IANA description reads: ‘POP3 over TLS protocol’.

Security Considerations

Port 995 is the recommended encrypted alternative to plaintext POP3 on port 110, and the protocol itself is well-defended at the transport layer. The IDS rule activity tied to this port reflects two distinct stories rather than one.

The first is Heartbleed (CVE-2014-0160), the OpenSSL flaw disclosed in April 2014 that allowed attackers to read arbitrary memory contents from a vulnerable TLS endpoint. Heartbleed affected any service running OpenSSL with a vulnerable version of the heartbeat extension, which made every TLS-bearing port a potential target, including POP3S on 995, IMAPS on 993, HTTPS on 443, and many others. Approximately half of the 46 IDS rules referencing port 995 in our dataset are dedicated to detecting Heartbleed exploitation attempts and suspicious heartbeat responses across SSLv3, TLSv1, TLSv1.1, and TLSv1.2. The flaw was patched within days of disclosure, and modern OpenSSL builds have not been vulnerable for over a decade.

The second story is malware using port 995 as a channel rather than attacking it. The remaining IDS rules are dominated by Emotet (MITRE S0367), which appears in 12 rules tied to this port, and the RedLeaves backdoor (MITRE S0153). Emotet is well-documented as a credential-stealing malware family that harvests email passwords from compromised systems, then uses those credentials to access mailboxes (often via POP3S or IMAPS) for further reconnaissance and to send spam from hijacked accounts. The presence of Emotet rules on port 995 reflects this access pattern: legitimate-looking authenticated POP3S connections from compromised endpoints to mail providers, hard to distinguish from normal user traffic at the network level.

Beyond these specific patterns, the security considerations for port 995 are the standard considerations for any TLS-bearing service: keep the TLS library current, prefer modern cipher suites, ensure certificate validation is enabled on the client side, and disable plaintext fallback.

Port 995 traffic from end-user devices to known mail provider domains is normal and expected. Sustained port 995 connections from a host that does not appear to be running a configured mail client, or to unfamiliar destinations, are worth investigating as potential indicators of credential-stealing malware.

IDS Rule References

34 IDS / security rules reference TCP port 995. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 4): attempted-recon (26), bad-unknown (5), trojan-activity (2), misc-activity (1).

Sample rule descriptions for TCP port 995:

• SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL SSLv3 large heartbeat response – possible ssl heartbleed attempt

Malware Activity

Some malware indicators are observed on this port.

2 of 34 IDS rules for TCP port 995 involve malware activity.

Families observed (top 1): RedLeaves (2).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).