Internet-Security.com TCP port 5904 details

TCP 5904 is commonly used by VNC (Remote Framebuffer/RFB) servers as display :4 (port 5900 + display number).
Real-world VNC servers that can listen on 5904 include RealVNC Server, TightVNC, TigerVNC/Xvnc, UltraVNC, and x11vnc when configured for display :4.
QEMU/Libvirt can expose a guest console via VNC on 5904 using options like -vnc :4, and VMware ESXi/Workstation can map a VM’s VNC console to port 5904 when configured accordingly.
Desktop-sharing tools such as GNOME Remote Desktop (VNC mode) and KDE Krfb (via TigerVNC) also use 5904 for an additional session on display :4.
Port 5904 is frequently scanned and abused in the wild as part of VNC-targeting brute-force and unauthorized-access campaigns when weak or default credentials are used.

TCP 5904