RDP attacks & scanning (port 3389)
Microsoft Remote Desktop — credential probing and BlueKeep-class exploitation.
Observed by OffSeq honeypot sensors · last 30 days · #9 most-attacked service · last seen 15 minutes ago
207,793
Attacks
4,886
Distinct source IPs
3389
Port · tcp
The #9 most-attacked service across the fleet in the last 30 days.
OffSeq honeypots emulating RDP recorded 207,793 attacks from 4,886 distinct source IPs over the last 30 days. Microsoft Remote Desktop — credential probing and BlueKeep-class exploitation.
Top CVEs exploited across the fleet (last 30 days)
Fleet-wide, not scoped to RDP.
- CVE-2017-01442,731
- CVE-2019-07082,655
- CVE-2024-45771,699
- CVE-2021-268551,670
- CVE-2017-9841542
- CVE-2025-5777269
- CVE-2023-3519150
- CVE-2012-212283