28,000 login attempts in 4 days: what happens when you expose Remote Desktop to the internet

Post by **rychy** » Sat Oct 31, 2026 8:32 am

28,000 login attempts in 4 days

Recently one of our computers had a problem many people know: Windows stopped letting its owner sign in. The password was correct, but the system said the account was locked.

It wasn't a forgotten password. Someone outside was trying to get in.

What we found

For remote work, Remote Desktop (RDP) was exposed directly to the internet on a non-standard port. Many people think that makes it "hidden". It doesn't.

The Windows log (Event Viewer → Security) showed:

about 28,000 failed sign-in attempts in 4 days, on average one every 12 seconds, day and night
dozens of different IP addresses from different countries
common user names: administrator, admin, user, test, and also the real user name

Windows has a protection: after 10 wrong attempts in 10 minutes it locks the account. It stopped the attack, but it also locked out the owner. The account was locked 7 times.

The good news: there was not a single successful sign-in from outside.

Why a "non-standard port" doesn't help

Bots scan the whole internet, every port, all the time. An open RDP is found within minutes to hours, whether it's on 3389 or any other port. Changing the port reduces the noise a little, but it is not protection.

What we did

Closed the port on the router. The attacks stopped immediately.
Allowed RDP only through a VPN (WireGuard). The computer is no longer visible from the internet. The phone or laptop first connects to the VPN and only then to Remote Desktop.
The VPN lets only specific devices reach the computer, not everyone who connects.

Result: 0 sign-in attempts since then, and access from the phone works as before.

How to check whether you're being attacked too

In Windows: Event Viewer → Windows Logs → Security, filter by Event ID 4625 (failed sign-in). If you see hundreds of entries from unknown IP addresses, your RDP is exposed.

Quick tips

Never expose RDP (3389) or SSH (22) directly to the internet unless it's absolutely necessary.
Use a VPN (WireGuard is free, fast and easy) or at least limit access to specific IP addresses.
Turn on account lockout after a few wrong attempts. In Windows it's on by default.
A long, unique password. For SSH, key-based sign-in is even better.
Check the log from time to time.

What about a VPS?

The same applies to every server on the internet.

On our Linux VPS you can choose the free "Server hardening" add-on. It opens only the ports you need, disables root login over SSH, limits sign-in attempts and turns on automatic updates.
On a Windows VPS use a long, unique password, change it after the first sign-in and don't use it anywhere else.

Have you had a similar case? Tell us in the topic