How to Use Shodan to Find Businesses With Open RDP Ports

June 5, 2026 • BizVuln Expert

Learn how security consultants and MSSPs can leverage Shodan to identify businesses exposing vulnerable RDP ports, assess risks, and guide remediation with actionable OSINT techniques.

How to Use Shodan to Find Businesses With Open RDP Ports

Remote Desktop Protocol (RDP) is a cornerstone of modern remote work, but when left exposed to the public internet, it becomes an open invitation for ransomware, brute-force attacks, and lateral movement. For Managed Security Service Providers (MSSPs) and security consultants, identifying exposed RDP ports on client networks—or on potential clients—is a critical step in proactive risk management. Shodan, the search engine for internet-connected devices, provides a powerful, free (and paid) resource for reconnaissance. This guide will walk you through using Shodan to find businesses with open RDP ports, interpret those findings, and translate them into actionable security recommendations for your clients or your own organization.

Why RDP Exposure Matters

RDP (typically port 3389/tcp) is a prime target for attackers. High-profile incidents—such as the 2019 ransomware attack on the City of New Bedford or the 2020 attack on the University of Utah—began with unsecured RDP. In 2025, despite widespread awareness, Shodan still indexes millions of exposed RDP instances worldwide. For an MSSP, discovering that a client’s remote access infrastructure is visible to the internet is a priority-one finding. Not only does it increase the attack surface, but it also violates many compliance frameworks (PCI DSS, HIPAA, NIST). Using Shodan for OSINT (Open Source Intelligence) allows you to perform these checks without deploying any agents or credentials, making it ideal for pre-engagement assessments, continuous monitoring, and vendor risk evaluations.

Getting Started with Shodan

Shodan indexes banner information from devices—everything from webcams to industrial control systems. For our purposes, we focus on devices responding on TCP/3389. You can start with a free Shodan account (limited results) or a paid membership (full API access and result export). The core interface is the search bar; advanced users leverage the search filters and Shodan CLI.

1. Basic RDP Search: Simply type port:3389 into Shodan. This returns millions of results—too broad for targeted business reconnaissance.
2. Refine by Country: Add country:US or country:DE to narrow by geography. Businesses often expose RDP from headquarter IP ranges.
3. Refine by Organization: Use org:"Company Name" to filter by autonomous system owner. For example, org:"Microsoft" would show Microsoft-owned IPs, but beware—this returns corporate infrastructure, not necessarily endpoints.
4. Refine by ASN: Many businesses use a specific ASN. Find it via tools like BGP.HE or by searching Shodan for asn:AS12345 port:3389.
5. Use netblocks: If you know a client’s IP range (e.g., 203.0.113.0/24), search net:203.0.113.0/24 port:3389.

Crafting Targeted Queries for Businesses

Finding a specific business’s exposed RDP requires combining multiple filters. Here are the most effective query patterns for security consultants:

1. Company Name + City/State

org:"Acme Corp" city:"New York" port:3389 — This uses the organization field, which may or may not contain the exact name. Shodan populates “org” from whois and BGP data, so large companies (e.g., "Example Inc.") appear, but small businesses may not.

2. SSL Certificate CN

If the RDP endpoint uses a self-signed or public SSL certificate (common with RDP over HTTPS on port 443), the Common Name (CN) often contains the company domain. Use ssl.cert.subject.cn:"example.com" port:3389.

3. Hostname Patterns

hostname:"*.example.com" port:3389 — This finds any device whose reverse DNS ends with your client’s domain. It’s particularly accurate if the client manages their DNS.

4. HTML Title or Custom Banners

Some organizations customize their RDP prompt or login screen. Shodan indexes the banner text. Search "Terms of Use" "Remote Desktop" port:3389 to catch custom messages. For businesses, try "Welcome to [Company Name] Remote Access".

5. Combine with Non-Standard Ports

Many admins move RDP to alternative ports (e.g., 3390, 8080) to avoid knocks. Scan for those with "Remote Desktop" port:3390. Shodan’s “Remote Desktop” service filter (product:"Remote Desktop") detects RDP by protocol fingerprint regardless of port.

Interpreting Shodan Results for Risk Assessment

Once you have a list of IPs with open RDP, the real work begins. Shodan provides metadata: open ports, geography, ISP, operating system (from banner), and services running. For MSSP purposes, you need to evaluate:

• Is it a real business endpoint? Home routers, residential ISPs, or cloud VPSes may show up. Cross-check the IP with whois (using Shodan’s or a third-party tool) to see if the netblock belongs to the client’s organization.
• What version of RDP? Shodan often lists the Microsoft Terminal Services version. Older versions (pre-Windows 10/Server 2016) have known vulnerabilities like BlueKeep (CVE-2019-0708).
• Is Network Level Authentication (NLA) enabled? Shodan can indicate if NLA is required (by analyzing the banner). Without NLA, the server is more susceptible to brute force and credential stuffing.
• Is SSL/TLS used? RDP over SSL (port 443/3389 with certificate) offers better encryption but is still risky if exposed.
• Are there other open ports? A host with RDP open often has other services (SMB, HTTP, SSH) that amplify the risk profile.

Pitfalls and False Positives

OSINT reconnaissance has limitations. Shodan may index devices that are now closed; results are not real-time. Also, a business might expose RDP through a VPN gateway or Microsoft Remote Desktop Gateway (RDGW) which only listens on the internet but requires proper authentication. Still, any exposure increases the attack surface. A common false positive is a third-party vendor hosting a terminal server for the business—this still represents a supply chain risk. Always validate with a non-intrusive scan (e.g., Nmap version detection) from a different vantage point if you have authorization.

Ethical and Legal Considerations

As an MSSP, you must operate within legal boundaries. Using Shodan to find open RDP ports is passive reconnaissance—it’s publicly available data. However, probing those ports (e.g., attempting to log in or scanning for vulnerabilities) without explicit permission is illegal in many jurisdictions and violates terms of service. This guide assumes you are using Shodan for pre-engagement assessment on your own infrastructure, with the explicit consent of the client, or for educational purposes. Always consult your legal counsel and follow a robust scope of work.

From Reconnaissance to Remediation

After identifying exposed RDP, your next steps depend on your engagement model. For a security consultant presenting a report:

• Prioritize: Flag any RDP exposed to the internet as a Critical finding. Provide the IP, hostname (if available), and detailed metadata from Shodan.
• Remediation advice: Recommend moving RDP behind a VPN, implementing Azure AD Application Proxy, or at least enabling NLA, using strong passwords, and setting up account lockout policies.
• Continuous monitoring: Set up Shodan alerts for your client’s netblock (paid feature) to receive email notifications when new RDP services appear. This is valuable for MSSP SOC teams.
• Integration with BizVuln: Use Shodan’s API to automatically pull exposure data into the BizVuln platform, correlating it with vulnerability scans and asset inventories for a unified risk dashboard.

Automating with Shodan API and BizVuln

Manual searching is fine for ad-hoc assessments, but for an MSSP managing dozens or hundreds of clients, automation is essential. BizVuln’s API-first architecture can ingest Shodan data via cron jobs or webhooks. Here’s an example workflow:

1. Define each client’s known IP ranges, domains, and ASNs in BizVuln’s asset configuration.
2. Use BizVuln’s built-in Shodan integration (or a custom script using the Shodan Python library) to query net:client_netblock port:3389 daily.
3. Compare results with BizVuln’s vulnerability database. For example, if Shodan reveals a Windows 7 RDP server, BizVuln assigns a Critical severity for BlueKeep.
4. Generate automated reports for clients with actionable remediation steps and prioritization.
5. Track remediation progress over time—has the client removed the exposed RDP? BizVuln’s compliance module can show trend lines for “Internet-facing RDP” risk.

Real-World Example: Finding a Client’s RDP Exposure

Let’s walk through a scenario. You are an MSSP conducting a pre-engagement assessment for a mid-size law firm, “Green & Associates.” Their domain is greenassociates.example. You suspect they have remote access set up for attorneys. Using Shodan:

• Search: org:"green associates" port:3389 → no results. (Their ISP doesn’t include the name in whois.)
• Search: hostname:"*.greenassociates.example" port:3389 → returns IP 192.0.2.45 with an RDP banner showing “Green & Associates – Secure Remote Access”.
• Click the IP to see details: OS is Windows Server 2012 R2, port 3389 open, no NLA (banner indicates “Terminal Services (Pre-NLA)”), and SSL is not enabled. Also, port 445 (SMB) is open.
• Cross-reference the IP with whois: it’s in a block owned by “Green Associates LLC”.

Findings for the report: Exposed RDP with no NLA on an EOL server (Windows Server 2012 R2 reached end-of-life in October 2023 but may still be under ESU—still risky). Additionally, SMB exposure increases ransomware risk. Your recommendation: immediately firewall that IP from the internet, migrate to Azure Virtual Desktop or a secure VPN solution, and patch or upgrade the OS.

Beyond RDP: Extending OSINT with Shodan

While this post focuses on RDP, Shodan is invaluable for other face services—SSH, Telnet, SMB, FTP, and database ports. MSSPs can build a comprehensive “external attack surface” assessment by running similar queries for: port:22 (SSH), port:445 (SMB), port:1433 (MSSQL), and port:23 (Telnet). Combining all these into BizVuln gives the Security Operations Center a single pane of glass for internet-facing risks.

Conclusion: Turning Shodan Intelligence into Business Protection

Shodan is not just a hacker’s toy; it is a legitimate tool for MSSPs and security consultants to proactively identify internet-facing risks before attackers do. By mastering targeted queries—using org names, hostnames, SSL certificates, and specific port filters—you can pinpoint business RDP exposure with high confidence. Then, by integrating that intelligence into your existing platform (like BizVuln), you shift from reactive incident response to proactive risk management. Every exposed RDP port is a potential breach. With Shodan and a structured methodology, you can find, assess, and fix these vulnerabilities, strengthening your clients’ security posture and demonstrating the value of continuous OSINT reconnaissance.

Start your next client engagement by searching for their RDP footprint—then lock it down before a ransomware group finds it first.