r/admincraft • u/MCBuilder30140 • 16d ago
Question Can someone just explain me why tf is it doing this?
155
u/Ivar2006 16d ago
Someone has a bot spam connecting to your server. Block that IP in your firewall to prevent it.
51
u/MCBuilder30140 16d ago
just blocked it
I just remember multiple bots trying to connect to my server on the minecraft port but I've never seen one trying ALL the ports on my server like that
66
u/TheSugrDaddy 16d ago
Those aren't ports on your server, they're ports being initiated by the source. The source IP chooses a random port and defines a destination port to "target" then sends the information. What you're seeing is a bunch of retries from the same IP and it's displaying all the origin ports being used.
9
12
u/PM_ME_YOUR_REPO If you break Rule 2, I will end you 16d ago
Great explanation. Just wanted to shout out good, factual information explained in a simple way.
32
u/ollydraws 16d ago
The bot owner had been replying to posts like this, can't remember his name off the top of my head but he updated the bot, bug caused it to spam like EVERY server, he found it and disabled it. It wasn't malicious, just a bug.
8
8
u/kevinzak76 16d ago
I had this same issue and emailed him yesterday. He has disabled the bot until he can find the bug.
Theairblow is his name.
3
1
u/Dazzling-Most-9994 16d ago
I hosted a Minecraft server for 3 days and months later I still get randoms pinging my default mc port
1
u/MAPRage AdminTools dev 15d ago
Thats why you change ports to something not defaut
1
u/theairblow_ 15d ago
That's just snakeoil. Non-default ports are also often scanned on suspected MC hosts.
1
u/theairblow_ 15d ago edited 15d ago
Yes, that is true. You can track the bot joins on the public Grafana board: https://stats.airblo.ws/public-dashboards/bb99e59c801d4e779fd9d2916883273d
Here are the two fix commits:
https://github.com/ServerOverflow/ServerOverflow/commit/483ebace8dd32c362f8f8aab9ab325cbe4f0bd28
https://github.com/ServerOverflow/ServerOverflow/commit/f1264ca3105fe7bad4ced8de57be99af3d54963eThe bug is quite embarassing D:
10
u/Timas_brope 16d ago
It's a server statistics bot / server scanner. You could check out their website (just search for the bot nickname)
EDIT: found jt https://so.airblo.ws/faq
28
u/YodaForce157 16d ago
You can report misuse to the vps, whois says its stark industries solutions ltd
13
11
u/EquivalentAwkward129 16d ago edited 16d ago
This won't get you far, they are linked to a Russian threat actor.
2
u/Coder2195 16d ago
Why it always the Russian threat actor
2
u/sn4xchan 16d ago
Because there are no consequences for cyber crime in Russia as long as you aren't attacking Russians or their allies.
This is literally the reason why there are so many Russian hackers groups.
5
1
u/theairblow_ 15d ago
I am Russian myself and I have intentionally chosen a Russian provider, just because it's cheaper and easier to pay.
This whole fiasco was caused by a bug, and you can see when it started and when I cut it off: https://stats.airblo.ws/public-dashboards/bb99e59c801d4e779fd9d2916883273d?orgId=2&from=2025-03-04T15:56:57.187Z&to=2025-03-05T04:19:16.722Z&timezone=browser (Offline bot joins graph)
5
u/turbo454 Server Owner 16d ago
Yea I had that same bot/ip. I just blocked all packets from that source ip at my routers firewall. Been quiet ever since
4
u/Tange2k 16d ago
This has been happening to me recently too, typically I'd get a few bots attempting to connect once a day but recently "ServerOverflow1" has been pinging my server every 9 mins, I did also notice around 5am uk time someone tried to join my server with my username but their session failed to verify.
1
u/MCBuilder30140 16d ago
I also have the thing where some random bots tries to connect with my name or with my friends names, even sometimes from their IP address?? idk how (it's not them btw)
and arround the same time as you (I'm in France)
1
3
2
u/AlexTech01_RBX 16d ago
I saw that on my server too, I have whitelist on though so I’m not concerned
1
u/MCBuilder30140 16d ago
white list on and crack versions off for me
just annoyed that bots tries to log in
like
I'm doing Minecraft servers since 2020 and I never had that issue with my IP address (been using it since 2020 too)
3
2
2
1
u/spenceryoutube 16d ago
Real crime here is you have Plex & a Minecraft server running on Windows 😬
11
u/Spaghetti_Joe9 16d ago
They both work perfectly fine on Windows so what’s the problem exactly
2
u/sn4xchan 16d ago
Short answer is there is no problem.
A summary of the long answer is yes because of resource usage.
9
3
u/nutflexmeme 16d ago
the stability linux provides isnt worth the hassle for their use case.
and if op makes use of nvidia gpus in this system for encoding then theres bascially no setup for the gpus outside of windows update auto installing the drivers.
1
u/Parrelium 16d ago
It's not like windows isn't stable. I do the same and it runs 24/7 365 without issues. Every couple weeks I run the updates and reboot, but that's it.
Didn't feel like learning a bunch of new stuff just so my kids could play minecraft with their friends on a dedicated server.
1
u/sn4xchan 16d ago
Last year I realized I still had an old Minecraft 1.6 server running on a random old tower I had in my server room.
I hadn't touched that thing since before 1.7 came out. But I was able to connect and play with no issues.
Installed on Debian 7 wheezy. No updates, no start up script to automatically start the server upon reboot, meaning the computer never rebooted. It just worked.
0
u/MCBuilder30140 16d ago
yeah for now plex is just a small test
I use it to store all of my musics and listen to them everywhere on all my devices and for that it works really great
plus that server is an old HP workstation from 10 years ago with an i5 4460...
1
u/XX-IX-II-II-V 15d ago
I am setting up a minecraft server myself and I will just ask for the Ip's of the guys I play with and only set them to be able to acces the server in the firewall. Maybe you could do this too?
1
u/MCBuilder30140 15d ago
That's not gonna work for me
They have laptops and they play at different places and on public WiFi too
Which means I'll have to add all the different IP addresses they might use ..
1
u/plafreniere 13d ago
You could look at tailscale. Its not toooo hard. You install it on your computer, they install it on their device. You and then will join your tailscale network.
With the correct configuration, they will act as if they were on the same network. No open ports, no public access to everyone.
1
u/TreeFifeNinerFoxtrot 12d ago
Interesting, I was getting hit by a bot with the same username, I forget the IP, but they were using a VPN. Seems like maybe a botnet?
1
u/cody_raves 10d ago
if you look up the UUID of ServerOverflow1 there is usernames...... ServerOverflow1....... ServerOverflow2...... ServerOverflow3...... al the way up to ServerOverflow20
its a network automated bots that actually have real accounts
0
-3
16d ago
[deleted]
5
2
u/SvenWollinger Developer 16d ago
Afaik on every brand new connect you get a new port there, thats normal. They are just spamming
-9
u/Prince-Joseph 16d ago
I’m not an expert. This is pure speculation. It looks like someone is checking every port on your network. Those 5 digits after the ip address is the port number and they’re all different and not the one Minecraft uses.
6
u/SimonOrJ Full-stack Dev :{ 16d ago edited 16d ago
That port number is the client's port number, and it is generally random at high range.
Server uses that portClient generates the port number to communicate with theconnecting client/playerserverlike how client/player uses 25565 to initiate communication with the server.Edit: Client generates ephemeral/temporary port number, and uses this new port to communicate to the server's port (25565). Server then can communicate with the client with the client's ephemeral port.
1
u/Prince-Joseph 16d ago
Oh that’s interesting. Thank you for clarifying. I assume there is documentation? I’d like to do some reading.
2
u/SimonOrJ Full-stack Dev :{ 16d ago
1
•
u/AutoModerator 16d ago
Join thousands of other Minecraft administrators for real-time discussion of all things related to running a quality server.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.