Internet-Security.com TCP port 585 details

TCP 585 was historically registered by IANA for IMAP4-SSL (implicit TLS for IMAP).
This use was deprecated and replaced by IMAPS on 993 (and STARTTLS on 143), but some legacy deployments still expose 585 for backward compatibility.
Real-world software historically associated with this port includes Dovecot, Courier-IMAP, UW-IMAP, and Cyrus IMAP, whose documentation references 585 as the old implicit-TLS IMAP port; older clients like Outlook and Thunderbird were sometimes configured to use it.
Some enterprise mail setups (e.g., legacy Exchange IMAP4 services or older Cyrus/Courier installs) have been observed keeping 585 open to support older configurations.
Major providers today (Gmail, Microsoft 365, Yahoo) do not use 585, relying on 993 instead.
Security note: because 585 often indicates legacy IMAP over SSL, attackers and scanners probe it to find outdated services and weak/obsolete TLS configurations for exploitation.

TCP 585