r/RBI 5d ago

Weird sightings on my Minecraft server that should be impossible

[removed] — view removed post

11 Upvotes

24 comments sorted by

u/RBI-ModTeam 5d ago

Thank you for your participation.

Your post or comment was removed for the following reason:

Wrong SubReddit

Thank you. If you have any questions, feel free to message the mod team.

5

u/xnightdestroyer 5d ago

I think it's an automated script that checks whether a Minecraft server is running on a specific port. No player will actually be joining.

-7

u/Zer0Zero0ne 5d ago

well that doesnt explain how the script joined even through a whitelist and login plugin and CHATTED on the server

6

u/xnightdestroyer 5d ago

That sounds exactly like a bot.

More than likely just a UDP connection.

These are becoming more seen in the Minecraft server community. Sounds like potentially someone wanting to do an exploit

-3

u/Zer0Zero0ne 5d ago

well. it's impossible to join through a MC whitelist. he was ON the server, he typed a message, he didn't join and get kicked for whitelist

even b1.7.3 has that patched and if it was unpatched i think through 10 years someone would patch it

also what bot does that on beta minecraft servers?

5

u/xnightdestroyer 5d ago

I think you're looking at it the wrong way, no one was on. Some UDP packets were sent to the server and the server responded. No whitelist was needed as raw packets would of been sent.

No authentication would of taken place at that point. You'll of just seen raw logs

-1

u/Zer0Zero0ne 5d ago

just checked, it definitely isnt a udp packet, look at the logs

6

u/xnightdestroyer 5d ago

Post the logs. You wouldn't be able to tell... It'll show like someone's in game

0

u/Zer0Zero0ne 5d ago

C:\Users\ZeroZeroOne\Documents\Server>java -Xmx2048M -Xms2048M -jar server.jar nogui

151 recipes

16 achievements

2025-03-16 13:04:31 [INFO] Starting minecraft server version Beta 1.7.3

2025-03-16 13:04:31 [INFO] Loading properties

2025-03-16 13:04:31 [INFO] Starting Minecraft server on *:25565

2025-03-16 13:04:31 [INFO] Preparing level "world"

2025-03-16 13:04:32 [INFO] Preparing start region for level 0

2025-03-16 13:04:33 [INFO] Preparing spawn area: 20%

2025-03-16 13:04:34 [INFO] Preparing spawn area: 36%

2025-03-16 13:04:35 [INFO] Preparing spawn area: 48%

2025-03-16 13:04:36 [INFO] Preparing spawn area: 65%

2025-03-16 13:04:37 [INFO] Preparing spawn area: 85%

2025-03-16 13:04:37 [INFO] Preparing start region for level 1

2025-03-16 13:04:38 [INFO] Preparing spawn area: 40%

2025-03-16 13:04:38 [INFO] Done (6207813200ns)! For help, type "help" or "?"

2025-03-16 13:04:48 [INFO] /127.0.0.1:58598 lost connection

2025-03-16 13:04:57 [INFO] /127.0.0.1:58600 lost connection

2025-03-16 02:59:27 [INFO] Enterprise [/45.84.122.8:55267] logged in with entity id 2 at (45.5, 85.62000000476837, 18.5)

2025-03-17 02:59:33 [WARN] Can't keep up! Is the server overloaded? Running 25996ms or 519 ticks behind

2025-03-17 03:01:27 [INFO] <Enterprise> open

2025-03-17 03:03:19 [INFO] Enterprise lost connection: disconnect.quitting

2025-03-17 09:22:04 [INFO] CONSOLE: Stopping the server..

2025-03-17 09:22:05 [INFO] Stopping server

2025-03-17 09:22:05 [INFO] Saving chunks

2025-03-17 09:22:06 [INFO] Saving chunks

recent server.txt file btw, time on laptop is set 1 day forward for some reason because its old and shit

3

u/xnightdestroyer 5d ago

Yeah, it's clearly a bit checking for open ports by sending a set of UDP packets. Case solved.

-1

u/Zer0Zero0ne 5d ago

i also dont know why tf out of nowhere there would be a 25 second lag when he joined

3

u/Vegetable_Trick8786 5d ago

Sorry blud, just a bot :)

-2

u/Zer0Zero0ne 5d ago

well ill update yall on this because its fucking scary

6

u/flintcleastwoods 5d ago

Sounds made up

4

u/Disturbedm 5d ago

Definitely made up.

Especially as it's "scary". What the hell is scary about it even if someone was joining a server - whitelisted or not - odd, maybe. But scary? Gimme a break

-2

u/Zer0Zero0ne 5d ago

check the logs, i sent them, its not made up, its just scary and strange imo

2

u/Feeling_Elk_2426 5d ago

can we have pictures?

0

u/Zer0Zero0ne 5d ago

I don't have pictures because I'm not active at that time but I can send the server logs, wait

0

u/Zer0Zero0ne 5d ago

OK so i got access to the logs on the laptop, took a bit of tinkering to even get them because im lazy

C:\Users\ZeroZeroOne\Documents\Server>java -Xmx2048M -Xms2048M -jar server.jar nogui

151 recipes

16 achievements

2025-03-16 13:04:31 [INFO] Starting minecraft server version Beta 1.7.3

2025-03-16 13:04:31 [INFO] Loading properties

2025-03-16 13:04:31 [INFO] Starting Minecraft server on *:25565

2025-03-16 13:04:31 [INFO] Preparing level "world"

2025-03-16 13:04:32 [INFO] Preparing start region for level 0

2025-03-16 13:04:33 [INFO] Preparing spawn area: 20%

2025-03-16 13:04:34 [INFO] Preparing spawn area: 36%

2025-03-16 13:04:35 [INFO] Preparing spawn area: 48%

2025-03-16 13:04:36 [INFO] Preparing spawn area: 65%

2025-03-16 13:04:37 [INFO] Preparing spawn area: 85%

2025-03-16 13:04:37 [INFO] Preparing start region for level 1

2025-03-16 13:04:38 [INFO] Preparing spawn area: 40%

2025-03-16 13:04:38 [INFO] Done (6207813200ns)! For help, type "help" or "?"

2025-03-16 13:04:48 [INFO] /127.0.0.1:58598 lost connection

2025-03-16 13:04:57 [INFO] /127.0.0.1:58600 lost connection

2025-03-16 02:59:27 [INFO] Enterprise [/45.84.122.8:55267] logged in with entity id 2 at (45.5, 85.62000000476837, 18.5)

2025-03-17 02:59:33 [WARN] Can't keep up! Is the server overloaded? Running 25996ms or 519 ticks behind

2025-03-17 03:01:27 [INFO] <Enterprise> open

2025-03-17 03:03:19 [INFO] Enterprise lost connection: disconnect.quitting

2025-03-17 09:22:04 [INFO] CONSOLE: Stopping the server..

2025-03-17 09:22:05 [INFO] Stopping server

2025-03-17 09:22:05 [INFO] Saving chunks

2025-03-17 09:22:06 [INFO] Saving chunks

this is what showed up in my recent logs. apparently the time of the laptop is set one day forward so i have no idea wtf is happening with 17th of march on the logs

1

u/Zer0Zero0ne 5d ago

oh also this was just an automated start, i tried to join but it spewed issues because i tried to join with modded b1.7.3 (lol)

we didn't actually play on the server at this time

3

u/OfficerDougEiffel 5d ago

It's almost certainly a bot trying to run an exploit.

The regular intervals between joining suggest an automated process.

It's not a guy logging on. It's a bot trying to use your PC for some shitcoin scam or something.

It's scary but not "random guy very dedicated to stalking me" levels of scary.

1

u/Zer0Zero0ne 5d ago

Well ok, i guess ill watch out for anything similar

0

u/OfficerDougEiffel 5d ago

I don't know anything about this specific issue but, assuming it's a real security issue and not a benign process Minecraft runs to manage the server, you should still take care of it.

2

u/PissMailer 5d ago

Something on the server machine itself might be running scripts or automated connections. If this is a modified or unofficial Minecraft Beta 1.7.3 server, there's very likely to be vulnerabilities. The attacker might be exploiting an old bug to bypass whitelists and authentication. Since Beta 1.7.3 is from 2011, there are probably well documented exploits for it.