If i run

netstat -an 

on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) enter image description here

The first IP Adress is mine, however i cant explain the other two connections. They both change their IP-Adress about every minute and if i google them, they ofthen have a negative reputation like being blacklisted or being a proxy. Is my server compromised? If so, i really canot explain it. The Server was setup yesterday and i literally didnt do anything except installing the recommend windows upgrades and downloading the Firefox Browser.


  • RDP will show an "established" TCP connection if someone is trying to test passwords against it, so just having established connections doesn't necessarily mean that someone is logged in.
    – user
    Commented Sep 20, 2021 at 17:38

2 Answers 2


It is probably not compromised - yet. But someone is trying to compromise it by connecting and presumably bruteforcing passwords.

Consider moving the RDP port to another port number, or enumerating the IPs that should be allowed to connect and block the others through a firewall.

  • i only connect to it from my private computer, which doesnt have a static IP. But i will take a look into it and maybe its possible to determine a ip-range. thank you for your answer!
    – J Doe
    Commented Sep 20, 2021 at 17:43

All that means is that remote systems are connecting to your RDP ports and probably trying different usernames and passwords. This is a known and expected side effect of making your RDP port open to the Internet; see What are the security risks of RDP?.

At a minimum, make sure your server is fully patched and that you're using strong passwords.

  • Ok, good to know. My password is strong already, but i think i will make it even stronger, just in case :8 Thanks for your answer!
    – J Doe
    Commented Sep 20, 2021 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .