Registered to 3COM-TSMUX, but in practice this is poppassd — cleartext mail password changes.
IANA assigns 106 to 3com-tsmux, a long-dead 3Com terminal-server multiplexer. What actually listens on 106 today is poppassd, a password-change daemon spoken by mail servers and control panels: the client sends user, pass, then newpass, and the daemon changes the account password through PAM. Qualcomm Eudora's "Change Password" button drove it, and mail hosting stacks kept it for webmail password changes. The exchange is entirely plaintext, which is why its own manual page tells you to bind it to loopback.
Do not expose
poppassd carries the old and the new password in cleartext; the upstream manual page recommends loopback-only access with everything else blocked.
$ sudo lsof -nP -iTCP:106 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.