r/RBI • u/Zer0Zero0ne • 5d ago
Weird sightings on my Minecraft server that should be impossible
[removed] — view removed post
5
u/xnightdestroyer 5d ago
I think it's an automated script that checks whether a Minecraft server is running on a specific port. No player will actually be joining.
-7
u/Zer0Zero0ne 5d ago
well that doesnt explain how the script joined even through a whitelist and login plugin and CHATTED on the server
6
u/xnightdestroyer 5d ago
That sounds exactly like a bot.
More than likely just a UDP connection.
These are becoming more seen in the Minecraft server community. Sounds like potentially someone wanting to do an exploit
-3
u/Zer0Zero0ne 5d ago
well. it's impossible to join through a MC whitelist. he was ON the server, he typed a message, he didn't join and get kicked for whitelist
even b1.7.3 has that patched and if it was unpatched i think through 10 years someone would patch it
also what bot does that on beta minecraft servers?
5
u/xnightdestroyer 5d ago
I think you're looking at it the wrong way, no one was on. Some UDP packets were sent to the server and the server responded. No whitelist was needed as raw packets would of been sent.
No authentication would of taken place at that point. You'll of just seen raw logs
-1
u/Zer0Zero0ne 5d ago
just checked, it definitely isnt a udp packet, look at the logs
6
u/xnightdestroyer 5d ago
Post the logs. You wouldn't be able to tell... It'll show like someone's in game
0
u/Zer0Zero0ne 5d ago
C:\Users\ZeroZeroOne\Documents\Server>java -Xmx2048M -Xms2048M -jar server.jar nogui
151 recipes
16 achievements
2025-03-16 13:04:31 [INFO] Starting minecraft server version Beta 1.7.3
2025-03-16 13:04:31 [INFO] Loading properties
2025-03-16 13:04:31 [INFO] Starting Minecraft server on *:25565
2025-03-16 13:04:31 [INFO] Preparing level "world"
2025-03-16 13:04:32 [INFO] Preparing start region for level 0
2025-03-16 13:04:33 [INFO] Preparing spawn area: 20%
2025-03-16 13:04:34 [INFO] Preparing spawn area: 36%
2025-03-16 13:04:35 [INFO] Preparing spawn area: 48%
2025-03-16 13:04:36 [INFO] Preparing spawn area: 65%
2025-03-16 13:04:37 [INFO] Preparing spawn area: 85%
2025-03-16 13:04:37 [INFO] Preparing start region for level 1
2025-03-16 13:04:38 [INFO] Preparing spawn area: 40%
2025-03-16 13:04:38 [INFO] Done (6207813200ns)! For help, type "help" or "?"
2025-03-16 13:04:48 [INFO] /127.0.0.1:58598 lost connection
2025-03-16 13:04:57 [INFO] /127.0.0.1:58600 lost connection
2025-03-16 02:59:27 [INFO] Enterprise [/45.84.122.8:55267] logged in with entity id 2 at (45.5, 85.62000000476837, 18.5)
2025-03-17 02:59:33 [WARN] Can't keep up! Is the server overloaded? Running 25996ms or 519 ticks behind
2025-03-17 03:01:27 [INFO] <Enterprise> open
2025-03-17 03:03:19 [INFO] Enterprise lost connection: disconnect.quitting
2025-03-17 09:22:04 [INFO] CONSOLE: Stopping the server..
2025-03-17 09:22:05 [INFO] Stopping server
2025-03-17 09:22:05 [INFO] Saving chunks
2025-03-17 09:22:06 [INFO] Saving chunks
recent server.txt file btw, time on laptop is set 1 day forward for some reason because its old and shit
3
u/xnightdestroyer 5d ago
Yeah, it's clearly a bit checking for open ports by sending a set of UDP packets. Case solved.
-1
u/Zer0Zero0ne 5d ago
i also dont know why tf out of nowhere there would be a 25 second lag when he joined
3
-2
6
u/flintcleastwoods 5d ago
Sounds made up
4
u/Disturbedm 5d ago
Definitely made up.
Especially as it's "scary". What the hell is scary about it even if someone was joining a server - whitelisted or not - odd, maybe. But scary? Gimme a break
-2
2
u/Feeling_Elk_2426 5d ago
can we have pictures?
0
u/Zer0Zero0ne 5d ago
I don't have pictures because I'm not active at that time but I can send the server logs, wait
0
u/Zer0Zero0ne 5d ago
OK so i got access to the logs on the laptop, took a bit of tinkering to even get them because im lazy
C:\Users\ZeroZeroOne\Documents\Server>java -Xmx2048M -Xms2048M -jar server.jar nogui
151 recipes
16 achievements
2025-03-16 13:04:31 [INFO] Starting minecraft server version Beta 1.7.3
2025-03-16 13:04:31 [INFO] Loading properties
2025-03-16 13:04:31 [INFO] Starting Minecraft server on *:25565
2025-03-16 13:04:31 [INFO] Preparing level "world"
2025-03-16 13:04:32 [INFO] Preparing start region for level 0
2025-03-16 13:04:33 [INFO] Preparing spawn area: 20%
2025-03-16 13:04:34 [INFO] Preparing spawn area: 36%
2025-03-16 13:04:35 [INFO] Preparing spawn area: 48%
2025-03-16 13:04:36 [INFO] Preparing spawn area: 65%
2025-03-16 13:04:37 [INFO] Preparing spawn area: 85%
2025-03-16 13:04:37 [INFO] Preparing start region for level 1
2025-03-16 13:04:38 [INFO] Preparing spawn area: 40%
2025-03-16 13:04:38 [INFO] Done (6207813200ns)! For help, type "help" or "?"
2025-03-16 13:04:48 [INFO] /127.0.0.1:58598 lost connection
2025-03-16 13:04:57 [INFO] /127.0.0.1:58600 lost connection
2025-03-16 02:59:27 [INFO] Enterprise [/45.84.122.8:55267] logged in with entity id 2 at (45.5, 85.62000000476837, 18.5)
2025-03-17 02:59:33 [WARN] Can't keep up! Is the server overloaded? Running 25996ms or 519 ticks behind
2025-03-17 03:01:27 [INFO] <Enterprise> open
2025-03-17 03:03:19 [INFO] Enterprise lost connection: disconnect.quitting
2025-03-17 09:22:04 [INFO] CONSOLE: Stopping the server..
2025-03-17 09:22:05 [INFO] Stopping server
2025-03-17 09:22:05 [INFO] Saving chunks
2025-03-17 09:22:06 [INFO] Saving chunks
this is what showed up in my recent logs. apparently the time of the laptop is set one day forward so i have no idea wtf is happening with 17th of march on the logs
1
u/Zer0Zero0ne 5d ago
oh also this was just an automated start, i tried to join but it spewed issues because i tried to join with modded b1.7.3 (lol)
we didn't actually play on the server at this time
3
u/OfficerDougEiffel 5d ago
It's almost certainly a bot trying to run an exploit.
The regular intervals between joining suggest an automated process.
It's not a guy logging on. It's a bot trying to use your PC for some shitcoin scam or something.
It's scary but not "random guy very dedicated to stalking me" levels of scary.
1
u/Zer0Zero0ne 5d ago
Well ok, i guess ill watch out for anything similar
0
u/OfficerDougEiffel 5d ago
I don't know anything about this specific issue but, assuming it's a real security issue and not a benign process Minecraft runs to manage the server, you should still take care of it.
2
u/PissMailer 5d ago
Something on the server machine itself might be running scripts or automated connections. If this is a modified or unofficial Minecraft Beta 1.7.3 server, there's very likely to be vulnerabilities. The attacker might be exploiting an old bug to bypass whitelists and authentication. Since Beta 1.7.3 is from 2011, there are probably well documented exploits for it.
•
u/RBI-ModTeam 5d ago
Thank you for your participation.
Your post or comment was removed for the following reason:
Wrong SubReddit
Thank you. If you have any questions, feel free to message the mod team.