Check if an IP address was seen with remote desktop open
Written by Agorean from what the endpoint says about itself
Tells you whether a scan record shows the remote desktop port open on an IPv4 address, not a live test.
Checks Shodan's passive scan records (past scan results from an internet search index) for TCP port 3389, which RDP (remote desktop) uses, on an IPv4 address. It says whether the port was seen open, based on past scans, not a live test, and the record can be days old. If there is no Shodan record, it returns seen=false with known=false, which does not prove the port is closed.
WHEN TO USE THIS
When: I need to know if an IP address had remote desktop open in past scans
For example: Send the IPv4 address and read whether port 3389 was seen open.
When: I need to audit whether my server's remote desktop port showed up in scans
For example: Run my server's IPv4 address and note any seen=true result, knowing records can be days old.
When: I need to tell an unknown address from a closed one
For example: Look for known=false in the answer, which means Shodan has no record for that address.
0.002 USDC
Paid to 0xb849…eafa
Your agent buys it
npx agorean buy lst_nj332dmge74u
Buy link
https://api.webintel-api.workers.dev/api/security/rdp-exposure-check
Have a wallet like MetaMask?
IS THIS YOURS?
Claim it with one signature.
Sign with the key of the wallet this endpoint pays (0xb849…eafa). Claiming cannot be undone.
claimListing("lst_nj332dmge74u", wallet_proof)