Internet-Security.com TCP port 5903 details

TCP port 5903 is commonly used by VNC (RFB protocol) as the port for display :3 (i.e., 5900 + 3).
RealVNC Server (VNC Connect) will listen on 5903 when configured to serve display :3.
TightVNC, UltraVNC, and TigerVNC likewise bind to 5903 for their display :3 sessions.
QEMU/KVM’s built‑in VNC console uses 5903 when started with “qemu -vnc :3,” and libvirt/virt‑manager can set graphics type='vnc' port='5903' for a guest.
VMware Workstation/ESXi can expose a VM console over VNC by setting RemoteDisplay.vnc.port=5903 in the VM’s configuration.
x11vnc and TurboVNC servers also use 5903 for display :3 in Linux/HPC remote visualization setups.
Because exposed VNC services are common targets, 5903 (like other 5900‑range ports) is frequently scanned and subjected to brute‑force attempts and exploitation of VNC authentication weaknesses.

TCP 5903