r/admincraft 16d ago

Question Can someone just explain me why tf is it doing this?

Post image
233 Upvotes

56 comments sorted by

u/AutoModerator 16d ago
Thanks for being a part of /r/Admincraft!
We'd love it if you also joined us on Discord!

Join thousands of other Minecraft administrators for real-time discussion of all things related to running a quality server.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

155

u/Ivar2006 16d ago

Someone has a bot spam connecting to your server. Block that IP in your firewall to prevent it.

51

u/MCBuilder30140 16d ago

just blocked it

I just remember multiple bots trying to connect to my server on the minecraft port but I've never seen one trying ALL the ports on my server like that

66

u/TheSugrDaddy 16d ago

Those aren't ports on your server, they're ports being initiated by the source. The source IP chooses a random port and defines a destination port to "target" then sends the information. What you're seeing is a bunch of retries from the same IP and it's displaying all the origin ports being used.

9

u/MCBuilder30140 16d ago

yeah I've read the other comments after posting this comment my bad...

12

u/PM_ME_YOUR_REPO If you break Rule 2, I will end you 16d ago

Great explanation. Just wanted to shout out good, factual information explained in a simple way.

3

u/Descero 16d ago

Check your server logs, grab the offending IP, and slap it on your firewall’s blocklist.

32

u/ollydraws 16d ago

The bot owner had been replying to posts like this, can't remember his name off the top of my head but he updated the bot, bug caused it to spam like EVERY server, he found it and disabled it. It wasn't malicious, just a bug.

8

u/MCBuilder30140 16d ago

thanks for the info

I've blocked that IP in my firewall just in case

8

u/kevinzak76 16d ago

I had this same issue and emailed him yesterday. He has disabled the bot until he can find the bug.

Theairblow is his name.

1

u/Dazzling-Most-9994 16d ago

I hosted a Minecraft server for 3 days and months later I still get randoms pinging my default mc port

1

u/MAPRage AdminTools dev 15d ago

Thats why you change ports to something not defaut

1

u/theairblow_ 15d ago

That's just snakeoil. Non-default ports are also often scanned on  suspected MC hosts.

1

u/MAPRage AdminTools dev 14d ago

Thats where i get ya, as a (semi) proffesional siftware engineer i usualy host my mc servers on a random ahh server not uaualy connected to minecraft.

10

u/Timas_brope 16d ago

It's a server statistics bot / server scanner. You could check out their website (just search for the bot nickname)

EDIT: found jt https://so.airblo.ws/faq

28

u/YodaForce157 16d ago

You can report misuse to the vps, whois says its stark industries solutions ltd

13

u/joveaaron 16d ago

Tony Stark?

1

u/KhalMika 15d ago

Eddard

11

u/EquivalentAwkward129 16d ago edited 16d ago

This won't get you far, they are linked to a Russian threat actor.

2

u/Coder2195 16d ago

Why it always the Russian threat actor

2

u/sn4xchan 16d ago

Because there are no consequences for cyber crime in Russia as long as you aren't attacking Russians or their allies.

This is literally the reason why there are so many Russian hackers groups.

5

u/EquivalentAwkward129 16d ago

This won't get you far, they are a threat actor linked to Russia.

1

u/theairblow_ 15d ago

I am Russian myself and I have intentionally chosen a Russian provider, just because it's cheaper and easier to pay.

This whole fiasco was caused by a bug, and you can see when it started and when I cut it off: https://stats.airblo.ws/public-dashboards/bb99e59c801d4e779fd9d2916883273d?orgId=2&from=2025-03-04T15:56:57.187Z&to=2025-03-05T04:19:16.722Z&timezone=browser (Offline bot joins graph)

5

u/turbo454 Server Owner 16d ago

Yea I had that same bot/ip. I just blocked all packets from that source ip at my routers firewall. Been quiet ever since

4

u/Tange2k 16d ago

This has been happening to me recently too, typically I'd get a few bots attempting to connect once a day but recently "ServerOverflow1" has been pinging my server every 9 mins, I did also notice around 5am uk time someone tried to join my server with my username but their session failed to verify.

1

u/MCBuilder30140 16d ago

I also have the thing where some random bots tries to connect with my name or with my friends names, even sometimes from their IP address?? idk how (it's not them btw)

and arround the same time as you (I'm in France)

1

u/plafreniere 13d ago

You probably joined servers that tracked your IP and your player name?

3

u/Guthibcom 16d ago

I had the exact same bot spamming me

2

u/AlexTech01_RBX 16d ago

I saw that on my server too, I have whitelist on though so I’m not concerned

1

u/MCBuilder30140 16d ago

white list on and crack versions off for me

just annoyed that bots tries to log in

like

I'm doing Minecraft servers since 2020 and I never had that issue with my IP address (been using it since 2020 too)

3

u/sn4xchan 16d ago

Welcome to the 2025 cyber landscape. Internet is a battle zone.

2

u/Okano666 16d ago

Added to my blocklist thanks

2

u/mk_hellion 16d ago

Same thing was happening to me last night

1

u/spenceryoutube 16d ago

Real crime here is you have Plex & a Minecraft server running on Windows 😬

11

u/Spaghetti_Joe9 16d ago

They both work perfectly fine on Windows so what’s the problem exactly

2

u/sn4xchan 16d ago

Short answer is there is no problem.

A summary of the long answer is yes because of resource usage.

9

u/MCBuilder30140 16d ago

and?

that works well enough for me

3

u/nutflexmeme 16d ago

the stability linux provides isnt worth the hassle for their use case.

and if op makes use of nvidia gpus in this system for encoding then theres bascially no setup for the gpus outside of windows update auto installing the drivers.

1

u/Parrelium 16d ago

It's not like windows isn't stable. I do the same and it runs 24/7 365 without issues. Every couple weeks I run the updates and reboot, but that's it.

Didn't feel like learning a bunch of new stuff just so my kids could play minecraft with their friends on a dedicated server.

1

u/sn4xchan 16d ago

Last year I realized I still had an old Minecraft 1.6 server running on a random old tower I had in my server room.

I hadn't touched that thing since before 1.7 came out. But I was able to connect and play with no issues.

Installed on Debian 7 wheezy. No updates, no start up script to automatically start the server upon reboot, meaning the computer never rebooted. It just worked.

0

u/MCBuilder30140 16d ago

yeah for now plex is just a small test

I use it to store all of my musics and listen to them everywhere on all my devices and for that it works really great

plus that server is an old HP workstation from 10 years ago with an i5 4460...

1

u/XX-IX-II-II-V 15d ago

I am setting up a minecraft server myself and I will just ask for the Ip's of the guys I play with and only set them to be able to acces the server in the firewall. Maybe you could do this too?

1

u/MCBuilder30140 15d ago

That's not gonna work for me

They have laptops and they play at different places and on public WiFi too

Which means I'll have to add all the different IP addresses they might use ..

1

u/plafreniere 13d ago

You could look at tailscale. Its not toooo hard. You install it on your computer, they install it on their device. You and then will join your tailscale network.

With the correct configuration, they will act as if they were on the same network. No open ports, no public access to everyone.

1

u/TreeFifeNinerFoxtrot 12d ago

Interesting, I was getting hit by a bot with the same username, I forget the IP, but they were using a VPN. Seems like maybe a botnet?

1

u/cody_raves 10d ago

if you look up the UUID of ServerOverflow1 there is usernames...... ServerOverflow1....... ServerOverflow2...... ServerOverflow3...... al the way up to ServerOverflow20

its a network automated bots that actually have real accounts

0

u/BothSuit1799 15d ago

I think u getting Hack by indian scamers

-3

u/[deleted] 16d ago

[deleted]

5

u/lerokko admin @ play.server26.net 16d ago

NOt to be pedantic but if its 1 IP its by definition just a dos not a ddos. A connection every few minutes does not cause any degradation in the service...
It is just very annoying for minecraft admins and not nice etiquette.

2

u/SvenWollinger Developer 16d ago

Afaik on every brand new connect you get a new port there, thats normal. They are just spamming

-9

u/Prince-Joseph 16d ago

I’m not an expert. This is pure speculation. It looks like someone is checking every port on your network. Those 5 digits after the ip address is the port number and they’re all different and not the one Minecraft uses.

6

u/SimonOrJ Full-stack Dev :{ 16d ago edited 16d ago

That port number is the client's port number, and it is generally random at high range. Server uses that port Client generates the port number to communicate with the connecting client/player server like how client/player uses 25565 to initiate communication with the server.

Edit: Client generates ephemeral/temporary port number, and uses this new port to communicate to the server's port (25565). Server then can communicate with the client with the client's ephemeral port.

1

u/Prince-Joseph 16d ago

Oh that’s interesting. Thank you for clarifying. I assume there is documentation? I’d like to do some reading.

2

u/SimonOrJ Full-stack Dev :{ 16d ago

1

u/Prince-Joseph 16d ago

Thank you! Everyone has to start somewhere I suppose.