Inbound connection attempt to exposed macOS Screen Sharing (VNC/ARD) port 5900 from external network

Duo Tech@duotech

•updated Aug 17, 2026•0•0•7

Detects external scanning and connection attempts against internet-exposed macOS Screen Sharing (port 5900), including mass scanning and coordinated multi-source probing, with an allowlist for known internal scanners.