{"uid":"cap_YxaIb16UVwBOK0WOh2WW2","slug":"sitecheck-web-intel-rdp-exposure-check-2dd59391","name":"SiteCheck Web Intel RDP Exposure Check","description":"Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.","url":"https://api.webintel-api.workers.dev/api/security/rdp-exposure-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 1.1.1.1 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_wiVAqeh4Cqwg7OBUP-PgH","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks Shodan's passive scan records to determine whether TCP port 3389 (RDP) has been seen open on a given IPv4 address.","exampleAgentPrompt":"Has Shodan ever seen RDP (port 3389) open on 203.0.113.45? I want to know if remote desktop is exposed on that IP.","exampleUseCases":[{"title":"Server hardening audit","prompt":"Check whether Shodan has any record of RDP being exposed on 198.51.100.22 — I'm auditing that server before we put it in production."},{"title":"Threat intel enrichment for suspicious IP","prompt":"I've got a suspicious IP address 185.220.101.10 in our logs — can you see if Shodan has ever detected port 3389 open on it?"},{"title":"Third-party vendor risk assessment","prompt":"We're onboarding a new vendor whose public-facing server is at 45.33.32.156. Can you check Shodan's passive data to see if they have RDP exposed?"}],"resultDescription":"Returns a JSON object indicating whether Shodan has a record for the IP (known: true/false) and whether port 3389 was seen open (seen: true/false). If the IP has no Shodan record, both known and seen are false — this does not confirm the port is closed. Records may be days old and reflect passive historical data, not a live probe.","failureModes":["IP not found in Shodan records returns seen=false, known=false — not proof port is closed","Stale data: Shodan record may be days or weeks old, not reflecting current state","Invalid IPv4 address format causes a validation error","IPv6 addresses are not supported","Rate limiting or payment failure (x402) may block the request"],"whenToPreferThis":"Use this endpoint when you need a quick, passive check of RDP exposure for a specific IPv4 address without performing an active port scan. Ideal for threat intelligence enrichment, attack surface assessments, or vendor risk reviews where Shodan's historical passive data is sufficient. Prefer this over live port scanners when stealth or speed matters, or when you want to avoid sending packets directly to the target. Not suitable when you need a real-time, authoritative confirmation that a port is currently open or closed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:39:42.898Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-rdp-exposure-check-2dd59391"}