VNC notifications example:

#!/bin/bash

alertme() {
    zenity --notify "Big brother watching"
}

while :
do    
  netstat -a | grep vnc | grep ESTABLISHED && alertme
  sleep 60 #wait 60 seconds
done

Notify-Send script with more options than zenity:

https://github.com/vlevit/notify-send.sh/blob/master/notify-send.sh

./notify-send.sh --expire-time=-1 --icon=/usr/share/icons/Humanity/apps/24/application-x-vnc.svg Subject Message

Alternative bash script inspired by notify-send:

#!/bin/bash
NOTIFY_ARGS=(--session
             --dest org.freedesktop.Notifications
             --object-path /org/freedesktop/Notifications)
APP_NAME="${0##*/}"
REPLACE_ID=0
EXPIRE_TIME=4000
ICON="/usr/share/icons/Humanity/apps/48/application-x-vnc.svg"
parse_notification_id(){
    sed 's/(uint32 \([0-9]\+\),)/\1/g'
}

HOSTNAME_TO_IGNORE_REGEX="\.example\.com"
#VNC loop
while true
do
  LOGGEDON=$(netstat -a -n | grep ":5900" | grep ESTABLISHED | sed 's/.*:5900 *\(.*\):.*/\1/g' | while read i; do host -t CNAME $i | head -1; done | sed 's/.* \(.*\)$HOSTNAME_TO_IGNORE_REGEX\./\1/g')
  if [ "`echo $LOGGEDON|wc -l`" -lt "2" ]
  then
    #Single VNC user, check again in 5 seconds
    sleep 5
  else
    #zenity --notification --text "Multiple VNC Conenctions:\n$LOGGEDON"
    HINTS="\"urgency\": <byte 1>"

    NOTIFICATION_ID=$(gdbus call "${NOTIFY_ARGS[@]}"  \
                            --method org.freedesktop.Notifications.Notify \
                            "$APP_NAME" "$REPLACE_ID" "$ICON" "Multiple VNC Connections" \
                            "$LOGGEDON" \
                            "[$ACTION]" "{$HINTS}" "int32 $EXPIRE_TIME" \
                          | parse_notification_id)
    sleep 4
    gdbus call "${NOTIFY_ARGS[@]}"  --method org.freedesktop.Notifications.CloseNotification "$NOTIFICATION_ID" >/dev/null
    NOTIFICATION_ID=$(gdbus call "${NOTIFY_ARGS[@]}"  \
                            --method org.freedesktop.Notifications.Notify \
                            "$APP_NAME" "$REPLACE_ID" "$ICON" "Multiple VNC Connections" \
                            "$LOGGEDON" \
                            "[$ACTION]" "{$HINTS}" "int32 $EXPIRE_TIME" \
                          | parse_notification_id)
    sleep 4
    gdbus call "${NOTIFY_ARGS[@]}"  --method org.freedesktop.Notifications.CloseNotification "$NOTIFICATION_ID" >/dev/null

  fi
  sleep 4
done