Internet-Security.com TCP port 5905 details

TCP 5905 is most commonly used by VNC servers as display :5 (VNC listens on 5900 + display number).
RealVNC Server will listen on 5905 when running a session on display 5.
TightVNC, TigerVNC, UltraVNC, and x11vnc also use 5905 when configured or when the server’s display is :5.
QEMU/KVM’s built-in VNC server (used by libvirt/virt-manager) exposes guest consoles on 5900+n, so a VM on display 5 appears on 5905.
VMware ESXi/Workstation can enable a per-VM VNC console on a chosen port in the 5900–5964 range, including 5905.
Remote access gateways like noVNC or Apache Guacamole commonly connect to backend VNC servers on 5905 when that’s the assigned port.
This port is frequently targeted by attackers scanning for exposed VNC services and attempting brute-force logins, as part of broader VNC port (5900–5905) attacks.

TCP 5905