VNC attacks & scanning (port 5900)
VNC/RFB remote desktop — unauthenticated access and auth-challenge capture.
Observed by OffSeq honeypot sensors · last 30 days · #1 most-attacked service · last seen just now
16,189,731
Attacks
2,297
Distinct source IPs
5900
Port · tcp
The #1 most-attacked service across the fleet in the last 30 days.
OffSeq honeypots emulating VNC recorded 16,189,731 attacks from 2,297 distinct source IPs over the last 30 days. VNC/RFB remote desktop — unauthenticated access and auth-challenge capture.
Top CVEs exploited across the fleet (last 30 days)
Fleet-wide, not scoped to VNC.
- CVE-2017-01442,731
- CVE-2019-07082,655
- CVE-2024-45771,682
- CVE-2021-268551,652
- CVE-2017-9841542
- CVE-2025-5777269
- CVE-2023-3519150
- CVE-2012-212283