A VNC server's built-in web server, handing a browser the Java applet viewer for display :0.
Classic VNC servers — RealVNC, TightVNC, UltraVNC, x11vnc — embed a small HTTP server at 5800 plus the display number, so display :0 answers on 5800. Fetch it and you get an HTML page plus a Java applet that then opens its own RFB connection to 5900. The applet half is dead in practice since browsers removed NPAPI Java, but the listener survives in older installs and is a dependable fingerprint that a VNC server is running next door. IANA has never assigned 5800; the whole convention comes from the VNC implementations.
Do not expose
It advertises a VNC server to anyone who loads the page, and the RFB service it fronts authenticates with a DES challenge over a key truncated to 8 characters, with no transport encryption. Reach VNC over SSH or a VPN instead.
$ curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5800/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.