# SiteCheck Web Intel RDP Exposure Check

> SiteCheck Web Intel RDP Exposure Check is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks Shodan's passive scan records to determine whether TCP port 3389 (RDP) has been seen open on a given IPv4 address.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/rdp-exposure-check?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-rdp-exposure-check-2dd59391
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YxaIb16UVwBOK0WOh2WW2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-rdp-exposure-check-2dd59391
```

Example prompt: Has Shodan ever seen RDP (port 3389) open on 203.0.113.45? I want to know if remote desktop is exposed on that IP.

## When to prefer this

Use this endpoint when you need a quick, passive check of RDP exposure for a specific IPv4 address without performing an active port scan. Ideal for threat intelligence enrichment, attack surface assessments, or vendor risk reviews where Shodan's historical passive data is sufficient. Prefer this over live port scanners when stealth or speed matters, or when you want to avoid sending packets directly to the target. Not suitable when you need a real-time, authoritative confirmation that a port is currently open or closed.

## Known failure modes

- IP not found in Shodan records returns seen=false, known=false — not proof port is closed
- Stale data: Shodan record may be days or weeks old, not reflecting current state
- Invalid IPv4 address format causes a validation error
- IPv6 addresses are not supported
- Rate limiting or payment failure (x402) may block the request

## How this service works

Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

## Output

Returns a JSON object indicating whether Shodan has a record for the IP (known: true/false) and whether port 3389 was seen open (seen: true/false). If the IP has no Shodan record, both known and seen are false — this does not confirm the port is closed. Records may be days old and reflect passive historical data, not a live probe.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 1.1.1.1 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-rdp-exposure-check-2dd59391/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)