{
  "port": 5915,
  "protocol": "tcp",
  "service": "Unassigned / VNC display :15",
  "oneLiner": "IANA leaves 5915 unassigned; anything listening is almost certainly VNC display :15.",
  "whatItIs": "IANA marks the whole block 5915-5962 Unassigned, so no service owns this number. The convention that fills it is RFB: a VNC server on display :N listens on 5900+N, which makes 5915 display :15. Hosts that hand out one display per VM or per user — QEMU/KVM, Proxmox (which documented 5900-5999 as its VNC console range), or a box running several Xvnc instances — climb into this range quickly.",
  "exposure": {
    "verdict": "never",
    "note": "An unregistered port in the VNC block is a remote-desktop session by default assumption; classic VNC auth is weak and unencrypted, so keep it behind SSH or a VPN."
  },
  "checkCommand": "nmap -Pn -sV -p 5915 TARGET",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    },
    {
      "title": "Proxmox VE — Ports used by Proxmox VE (VNC Web console 5900-5999)",
      "url": "https://pve.proxmox.com/wiki/Ports",
      "kind": "official-docs"
    }
  ]
}