Internet-Security.com TCP port 5909 details

TCP port 5909 is used by VNC (RFB protocol) as display :9 (VNC servers listen on 5900 + display number).
TightVNC and UltraVNC servers will listen on 5909 when configured for display 9; clients connect as host:9 or host:5909.
RealVNC (VNC Server) uses 5909 when the “Port offset” is set to 9.
TigerVNC’s Xvnc/Xorg module listens on 5909 when started as :9 (for example, Xvnc :9).
QEMU’s built‑in VNC server binds to 5909 with the option -vnc :9; libvirt/virt‑manager often exposes VM consoles on this port accordingly.
VMware (Workstation/ESXi) can enable a per‑VM VNC server and set its port explicitly (e.g., RemoteDisplay.vnc.port = 5909).
Because it’s a VNC port, 5909 is frequently scanned and brute‑forced when exposed to the internet; use strong authentication and tunnel or encrypt access.

TCP 5909