Port 3389 runs the Windows Remote Desktop Protocol, over TCP and additionally UDP for better performance. Linux servers with xrdp use the same port.
Never expose it directly. Open RDP is one of the most common ransomware entry points – brute force and flaws like BlueKeep. Allow access only via VPN or an RD Gateway (HTTPS on 443), always with Network Level Authentication (NLA) and account lockout.
Common errors: CredSSP encryption oracle with mismatched patch levels on client and server, and disconnects when UDP 3389 is partially filtered.
Check
nc -vz rdp.example.com 3389