Loading...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp ms-term-services MS Terminal Services
udp ms-term-services MS Terminal Services
tcp ms-wbt-server MS WBT Server
udp ms-wbt-server MS WBT Server
Top IPs Scanning
Today Yesterday
94.102.49.119 (5837)94.102.49.119 (15635)
79.124.62.59 (521)79.124.62.59 (1508)
80.66.83.201 (496)185.234.216.123 (1432)
38.132.109.181 (376)176.113.115.123 (1321)
176.113.115.123 (355)79.124.62.62 (1009)
79.124.62.62 (339)198.12.68.106 (589)
109.205.213.108 (338)38.132.109.101 (581)
71.6.232.28 (332)45.130.145.60 (571)
185.234.216.123 (293)185.200.116.47 (569)
103.99.2.156 (248)78.128.114.90 (510)
Port diary mentions
URL
Virus Alphabet, War!, Port 3389 Spike, WinZip Issues
MS Advisory on the Vulnerability in RDP; Port 3389; FormMail Attempts
Port 3389 terminal services scans
Increased Traffic on Port 3389
An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
Did the recent malicious BlueKeep campaign have any positive impact when it comes to patching?
Top of page
User Comments
Submitted By Date
Comment
Scott Fendley 2005-07-17 03:13:54
Potential exploit of Remote Desktop Protocol on Windows Systems. Please see http://isc.sans.org/diary.php?date=2005-07-15 and http://isc.sans.org/diary.php?date=2005-07-16 for more information.
jeff bryner 2002-11-09 21:16:59
See http://www.xato.net/reference/xato-112001-01.txt for a discussion on how terminal services source ip address can be easily spoofed; so don't trust event log entries of connection attempts. Jeff.
Top of page
CVE Links
CVE # Description
CVE-2012-0002 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability."
CVE-2015-2373
CVE-2019-0708
Top of page