31.3 Million SSH Services and 16.5 Million RDP Endpoints: Building a Remote-Access Inventory
Remote access is the one capability every organization needs and no organization enjoys auditing. A recent measurement round provides a scale reference for how much of it is observable from the outside, and a method for turning that scale into a usable inventory.
The measurements
Queries were run on 20 October 2026 between 22:33 and 22:37 UTC with sub_type="all" and a page size of one record.
| Query | Matched assets |
|---|---|
service="ssh" |
166,939,313 |
service="rdp" |
16,527,336 |
app="OpenSSH" |
137,173,523 |
os="Windows Server" |
8,151,493 |
service="ldap" |
1,089,053 |
is_bugbounty=true |
61,676 |
Why SSH outnumbers RDP by ten to one
SSH at 166.9 million against RDP at 16.5 million is a ratio that reflects deployment reality rather than security posture. SSH is embedded in network equipment, storage arrays, hypervisors, container hosts and IoT devices; it is the default management protocol for a large share of the Linux-based world. RDP is concentrated in Windows estates and is more often firewalled to a corporate network.
Neither number indicates a vulnerable service. An SSH daemon that permits only key authentication, from an allowlisted address, on a non-default port, is not an exposure problem even though it is visible.
That distinction is the core discipline of this analysis. Protocol visibility and security posture are separate facts, and reports that merge them produce alarming but unactionable outputs.
The useful comparison
app="OpenSSH" at 137 million against service="ssh" at 166.9 million is the more instructive pair. The gap of roughly 30 million describes hosts answering SSH whose fingerprint is not recognized as OpenSSH — embedded implementations, minimal images, appliances with custom banners.
The practical implication: product-fingerprint queries miss a substantial fraction of SSH-capable devices. An inventory built on app="OpenSSH" will be incomplete for network equipment.
For os="Windows Server" at 8.1 million against RDP at 16.5 million, the relationship runs the other way. RDP endpoints exceed identified Windows Server hosts, which means a large share of RDP endpoints are not classified as servers — desktop operating systems, appliances exposing RDP, or hosts whose OS fingerprint failed.
Building the inventory that an incident will demand
When an edge device is compromised, the first questions are always the same: what could it reach, and what could reach it. An inventory that answers those questions looks different from an asset register.
Map remote access by direction. Who can connect to what, from which network, using which protocol. The reverse direction matters equally: what a compromised host could connect out to.
Record authentication mode per endpoint. Password, key, certificate, MFA. This determines whether a credential leak is immediately exploitable.
Note the management plane separately. An SSH service for automation is not the same as an administrative shell for humans, even when it is the same binary on the same port.
Establish what is internet-reachable versus internally reachable. These are different risk classes and should be counted separately. External observation can help confirm the first; only internal data can establish the second.
The bug bounty number as a sanity check
is_bugbounty=true returned 61,676. This is a useful calibration: a large share of internet-facing systems belong to organizations that have explicitly invited testing. The remainder have not, which does not imply they are unmaintained — only that visibility and consent are different things.
For defenders, the bug bounty flag is a way to check whether a host you thought was internal is actually in scope for a public program. That would be a surprising finding and worth knowing.
What to do with this data this quarter
A defensible quarterly exercise:
- Query the protocols you actually expose: SSH, RDP, and any management protocols for appliances you operate.
- Restrict the returned set to your own address space where possible, and otherwise to regions and providers you use.
- Diff against internal records; every unmatched host is a question for an asset owner.
- Repeat with identical queries to establish change over time.
- Publish an internal count of internet-reachable management endpoints, with an owner per endpoint.
The fifth item is unglamorous and has the largest effect. Most organizations cannot name the owner of every internet-reachable management service they operate, and the inability to name an owner is itself the finding.
References
- ZoomEye, search interface, queried 20 October 2026 for the dorks listed above.
- CISA, Known Exploited Vulnerabilities Catalog.
- Microsoft, RDP security guidance.
