X11 display :25 — high display numbers like this usually mean many forwarded or virtual sessions.
IANA assigns the whole 6000-6063 range to X11, so 6025 is display :25. Display numbers this high normally come from a multi-user host: sshd hands each X11-forwarded session the next free display starting at :10, and Xvfb/Xvnc farms allocate them in bulk for headless browsers and test runners. Seeing it listening on a public interface means the X transport was left on TCP rather than confined to the loopback socket sshd normally uses.
Do not expose
Forwarded and virtual displays carry real sessions; exposing them over TCP hands out screen contents and input injection with only a cookie in the way.
$ xdpyinfo -display TARGET:25Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.