RDP Exposure Across the EU: A Snapshot from Shodan Data

Methodology

EU-27 country filter used:

AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE

Query used:

• RDP exposure on port 3389 responding.

Note: Not every service running on port 3389 is necessarily Microsoft RDP. Some systems may run other services on that port. However, the overwhelming majority are Remote Desktop Protocol services.

Total RDP Exposure in the EU

Total exposed RDP services: 416,856

This makes RDP one of the largest exposed remote access surfaces in the EU.

Germany accounts for nearly 40 percent of all EU RDP exposure. The Netherlands ranks second, likely reflecting infrastructure density and hosting presence rather than weaker security.

What Is Actually Running?

The vast majority are genuine RDP services. The small number of non RDP fingerprints highlights why port based data should always be treated as a snapshot, not perfect protocol validation.

Operating System Breakdown

Modern Windows versions dominate the dataset, which is encouraging. However, we still see:

• Windows Server 2008 variants
• Windows 7 systems
• Server 2003 remnants
• Embedded and Linux based systems

Older Windows versions are a red flag. Unsupported operating systems exposed via RDP significantly increase risk.

Is Exposed RDP a Security Problem?

Yes, but with nuance. Unlike SMB or Telnet, RDP does have legitimate public-facing use cases. The issue is that exposed RDP is one of the most attacked services on the internet.

Attack patterns include:

• Automated brute force password attempts
• Credential stuffing
• Exploitation of RDP vulnerabilities (e.g., BlueKeep)
• Ransomware initial access
• Lateral movement after credential compromise

A password only RDP server exposed to the internet is a brute force magnet. Attackers do not manually scan for RDP anymore; botnets do it continuously.

From a Pentester Perspective

In a real world security assessment, severity depends on configuration. RDP becomes a High finding when:

• It is publicly reachable with no IP restrictions
• No multi-factor authentication (MFA) is enforced
• Weak or reused passwords are permitted
• No account lockout policy exists

If we successfully authenticate using weak credentials, default credentials, or credential reuse, the finding becomes Critical. Exposure combined with unsupported systems or serious CVEs compounds risk.

Important Context and Limitations

This analysis is based entirely on Shodan data.

Shodan continuously scans internet facing services, but it does not have full visibility. Some hosts may block Shodan scanners. Others may not yet be indexed at the time of analysis.

These numbers represent observed exposure, not a complete census of all internet exposed RDP services. Remember that a service can be on another port and on this research we focused on the specific ports so thats why visibility is not 100% accurate.

It is reasonable to assume the real number is higher.

Additionally:

• Not every service on port 3389 is guaranteed to be RDP
• OS fingerprinting may not always be exact
• Some systems may be honeypots or research deployments

Exposure does not automatically mean compromise.

But exposure combined with weak configuration significantly increases the likelihood of compromise.

Final Thoughts

416,856 exposed RDP services across the EU represent a substantial remote access surface. RDP is not inherently insecure, but poor configuration makes it a primary target for ransomware and credential-based attacks.

Visibility is the first step. Hardening, monitoring, and strict authentication are what actually reduce risk.