IMAP (143/993): banner grab + LOGIN brute force POP3 (110/995): banner grab + USER/PASS brute force Both registered as safe default plugins with auth-check capability.