109

Port 109/tcp is registered with IANA as pop2 with the description "Post Office Protocol - Version 2," assignee Joyce K. Reynolds, and a blank reference field (dual-registered on TCP and UDP). POP2 is defined in RFC 937 (February 1985, M. Butler, J. Postel, D. Chase, J. Goldberger, and J. K. Reynolds), which obsoleted the experimental POP1 of RFC 918. It is a deliberately minimal mail-retrieval protocol that lets a workstation download and read mail held on an always-up mailbox server: over a TCP connection the client authenticates with HELO, then uses READ and RETR to fetch messages and the acknowledgment commands ACKS, ACKD, and NACK to keep, delete, or keep-on-failure, before QUIT — and the spec's guidance is simply to close the connection if anything goes wrong. The IANA reference field is blank. POP2 was superseded by POP3 (RFC 1939, port 110, covered in an earlier batch) and is obsolete; one real implementation was the University of Washington ipop2d daemon shipped in 1990s–2000s Unix mail packages. Security-wise, POP2 uses plaintext authentication, offers no transport encryption, and has essentially zero modern footprint, so an open 109 indicates a misconfigured or decades-old mail host. For an analyst, an open 109 is a strong sign of a very old or neglected mail server and should be treated as obsolete plaintext and shut down.

IANA assignment

pop2 — "Post Office Protocol - Version 2"; reference (blank — no RFC cited in IANA registry); assignee Joyce K. Reynolds; dual-registered 109/tcp + 109/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

minimal/near-zero open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

110 (pop3), 995 (pop3s), 143 (imap), 993 (imaps)

Primary use

early client mail retrieval (RFC 937); obsolete

Other/unofficial uses

none notable today [Well-established]

Security implications

plaintext auth, no encryption; superseded by POP3; an open 109 indicates a misconfigured/decades-old host; disable [Well-established]

Typically seen on

legacy Unix mail hosts (e.g. UW ipop2d)

Analyst note

An open 109 is a strong indicator of a very old or neglected mail server; treat as obsolete plaintext and shut down.

Port 109/udp is registered with IANA as pop2 with the description "Post Office Protocol - Version 2," assignee Joyce K. Reynolds, and a blank reference field. The entry is dual-registered: 109/tcp and 109/udp carry byte-identical service name, description, and assignee in the IANA registry, differing only in the transport-protocol column. POP2 is an early, now-obsolete mail-retrieval protocol — the direct predecessor of POP3 (port 110), which superseded it and is itself now largely displaced by IMAP (143/993). As it was historically deployed in early Unix and Berkeley mail systems, POP2 ran over TCP; the UDP assignment on port 109 is a registry-level pairing rather than evidence of any common UDP-based POP2 traffic. Both IANA and the compiled Wikipedia port table list 109/udp as assigned/registered rather than as a protocol with active, independent UDP usage. No current, actively maintained software could be verified as speaking POP2 over UDP on port 109. For an analyst, port 109 is not a meaningful modern exposure surface: POP2 is obsolete, so a scanner touching port 109 is almost always running a broad legacy-port sweep rather than targeting a live POP2 service. Crowd-sourced port-reference sites (SpeedGuide, AuditMyPC) attach vague, low-confidence historical trojan/malware associations to port 109, but these are database-artifact tags from community sites rather than authoritative vendor or CERT advisories, and no specific malware family or dated incident could be confirmed from a primary source. A dated (March 2000) seclists.org thread shows historical community interest in scanning port 109, but that is 26-year-old context, not current threat intelligence, and no current-day scanning-prevalence figure (Shodan/GreyNoise/SANS ISC) was verified in this pass.

IANA assignment

pop2 — "Post Office Protocol - Version 2"; reference (blank — no RFC cited in IANA registry); assignee Joyce K. Reynolds; dual-registered 109/tcp + 109/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, :287; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml)

IANA Reference field

blank — the registry record for pop2 contains no <reference> element, only a person cross-reference to Joyce_K_Reynolds. Do not attribute an RFC (e.g. RFC 937) that IANA itself does not cite here [Confirmed] — IANA registry XML

Registration/Modification date

Unknown — blank in the source registry for this entry; not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Related ports

110 (pop3, the successor), 143/993 (IMAP); the mail-retrieval cluster

Primary use

POP2 (Post Office Protocol, Version 2) — an early, obsolete mail-retrieval protocol, predecessor to POP3 (110). As historically deployed POP2 ran over TCP; the UDP assignment is a registry pairing, not evidence of active UDP usage [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml, https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Common software

Unknown — no current, actively maintained product could be verified as implementing POP2 over UDP/109; POP2 itself is obsolete [Unknown]

Security implications

not a meaningful modern exposure; scanners touching 109 are typically doing broad legacy-port sweeps. Crowd-sourced sites (SpeedGuide, AuditMyPC) tag port 109 with vague historical trojan associations, but these are low-confidence database artifacts, not authoritative advisories; no specific malware family or dated incident confirmed from a primary source

Dated context

a March 2000 seclists.org thread discusses scanning interest in port 109; historical only, not current threat intel; no current (2025–2026) prevalence figure verified [Confirmed] — https://seclists.org/incidents/2000/Mar/114

Analyst note

An open port 109 is anomalous given POP2's obsolescence — treat as a legacy artifact or broad-sweep target and investigate context rather than assuming an active mail service.