How IMAP and POP3 Work: Reading Email, Legacy Auth & Password Spraying (Animated)

SMTP delivers mail to a mailbox; IMAP and POP3 let your mail app read from it. IMAP keeps mail on the server and syncs every device; POP3 downloads it. Old-style IMAP/POP3 logins accept just a username and password, which is why attackers love them.

1. Log in: greeting and login

The client connects (ideally on 993 with TLS) and logs in. Every IMAP command starts with a tag like A1 so replies can be matched.

1. * OK (Mail server → Your laptop): The server greets the client.
2. A1 LOGIN (Your laptop → Mail server): Username and password, nothing else.
3. A1 OK (Mail server → Your laptop): Logged in.

Wireshark filter:

imap

2. Read mail: select a folder, fetch messages

IMAP works on folders kept on the server. The client selects INBOX, learns how many messages there are, and fetches the ones it needs.

1. A2 SELECT (Your laptop → Mail server): Open the inbox.
2. * 312 EXISTS (Mail server → Your laptop): Counts come back.
3. A3 FETCH (Your laptop → Mail server): Fetch the newest headers.
4. FETCH (Mail server → Your laptop): The mail app shows the new messages; they stay on the server. (POP3 would instead download them with RETR and often delete them.)

Wireshark filter:

imap.request.command == "FETCH"

3. Password spraying: attack: one common password, many accounts

Attackers take a list of staff email addresses and try one or two common passwords against each, slowly enough to avoid lockouts. Legacy IMAP/POP3 logins are a favourite target because they accept just a password and skip MFA.

1. LOGIN (Attacker → Mail server): One attempt per account keeps under the lockout limit.
2. A1 OK (Mail server → Attacker): One weak password is enough to read a mailbox, often the start of invoice fraud.

Wireshark filter:

imap.request.command == "LOGIN"

4. Modern auth only: defence: no password-only mail logins

Disable legacy IMAP/POP3 authentication (or the protocols entirely), require modern sign-in with MFA, use TLS ports only, and alert on one source trying many accounts.

1. LOGIN (Attacker → Mail server): Password-only logins are refused for everyone.

Admin checklist:

Block legacy authentication · require MFA
SIEM: one IP failing logins for > 10 different users → alert

FAQ