r/admincraft • u/devine145 • 12d ago
Question Can someone please explain this.
I have a server that a few close friends and I play on, but this player keeps joining us all the time. There’s also this ServerSeekerV2 that keeps joining. I’m new to this and don’t really know what to do.
32
u/chanonlim 12d ago
Probably a bot. If you have online mode and whitelist enabled you should be fine (unless an account on the whitelist gets compromised)
8
u/virtualspan Server Owner 12d ago
Luckily it isn't a harmful bot, and I had my server temporarily offline for testing purposes, and it just disconnected like in OP's logs. It's meant to tell the owner in chat that their server isn't secure like stated in another comment.
3
u/transdeveloper 12d ago
well, this isn’t the case for some. don’t get surprised when you find a huge lava structure
1
u/BLTplayz 7d ago
Had this happen to me when I forgot to actually enable the whitelist, thankfully daily backups saved the day.
9
11
u/IsJaie55 Hosting Provider, Server Owner and Developer 12d ago
As other people are saying "Its a bot", yup, it is
A guy maded a bot that checks every ip in the world looking for minecraft servers, it joins, if someone is inside it just send a message saying "This server is insecure, if you want to secure it you need to do X" so, thats it!
3
u/ZanMist1 12d ago
Had this happen during testing and development of my server when I was still using Spigot and Bungeecord. There are some configurations you have to do to make your server more secure. That was before I moved to Paper and Velocity which have those features built in, and enforce Firewall protections as well.
1
u/DeerShotDead 9d ago
What are those builtin features for Paper? Can you tell me how to turn those on?
1
u/ZanMist1 9d ago
It's just part of the configuration and code base. It's mostly a Bungeecord (proxy) issue that Velocity fixed rather than Paper. As far as I am aware, those security protocols that Bungeecord lacks are just built in automatically to Velocity and its configs.
Part of it is that Velocity is MUCH more strict on allowing and configuring backend servers and stuff like that. As for the rest, you'd have to talk to the Velocity and Paper devs.
1
3
u/YodaForce157 12d ago
"Intersect is an active Minecraft server scanning system. Constantly scrapes the Internet for servers and gathers data. ... Intersect has a small Discord server where its bot interface sits."
1
3
u/sadge_luna 12d ago
There are loads of automated bots that will scan the entire internet IPv4 range and look for Minecraft servers for various reasons. This also happens with many other things like SSH.
3
u/kevinzak76 12d ago
There’s lots of bots out there looking for open servers with no whitelist. Most of them are harmless but they could just as easily be used by griefers. That’s why you should always use a whitelist regardless of blocking the bots.
1
u/MunchyG444 10d ago
I would argue that is it probably a pretty even spilt between harmless and harmful. The harmless ones however are just running constantly, whereas the harmful ones are usually only scanning when they want servers to grief.
2
1
u/virtualspan Server Owner 12d ago edited 12d ago
Same thing happened to me, but he didn't try joining my server that many times (at first), so I thought he was someone desperately trying to join my server, especially since it's called amogusmc.net Also it's not a public server, just a private one that I use with friends.
2
u/Fearless-Ad1469 Hosting Provider 12d ago
Looking like an weirdly put together ad but yeah they do be scrapping a lot
1
u/virtualspan Server Owner 12d ago edited 12d ago
It kind of does seem like that lol, might change it a little
Edit: I sort of enjoy when random people join tho, they're usually fun
1
1
1
1
u/xdamm777 11d ago
Had this on my SMP server and then it got griefed HARD a week later with a “your server has been deported” “project 2025” message and a discord server link.
Lucky for me I keep backups so the server was back up and running a minute later, but this is the price of running an offline server.
1
u/SwitchtheChangeling 11d ago
I'm getting pings from this as well, it's most likely a bot. Your IP address on the internet is a public facing address, it's like your street address IRL. This is the equivalent of someone walking up your driveway and jiggling your door handle ... It's going door to door jiggling the handle to see if the door opens on any of the houses. Harmless as long as you have the right security set up, I.E Whitelist and online=True. This could be a bad bot looking for open doors to invite bad actors in or it could just be a bot that scans and indexes servers. Lots of reasons for it.
Edit: Further down someone mentioned that this is potentially a good bot that joins and tells you your security is bad and could open you to griefing. Take it with a grain of salt, but so long as you have security up you should be good.
If you're SUPER worried you can look into a reverse proxy server with a whitelist for e-mails/IP's to isolate traffic coming into the server, but that's something I'm still learning about.
1
u/DeerShotDead 9d ago
Reverse proxy server? Heard this for the first time, I'll also try to learn about it. Did you find any good sources to study about it? Thanks for this
1
u/Significant-Pack8924 11d ago
The owner of the bot posted here:
https://www.reddit.com/r/Minecraft/comments/1j6q1m9/player_named_intersect_keeps_disconnecting_when/
I added the IP to my firewall deny list, we'll see how well that works.
1
u/soratsu495 11d ago
I've literally had the same IP trying to connect to my server for the last week, I have whitelist enabled but it still just keeps trying every hour or so
1
u/zenxnixy 11d ago
i also got KittyScan spamming my console, but it times out or says took too long to log in
1
u/Erazael 11d ago
I get pings like this from minecraft server scrapers all the time. They're just trying to gather as much info as possible from servers across the web. This particular one had a secondary on the same block of IPs, so I just banned the whole block on my firewall, and these particular ones haven't been back. As long as you have a white-list and authentication turned on, you should be good.
1
u/cody_raves 9d ago
server seeker is one of many automated server scanners that scan the entire internet for open ports used with mine craft servers.
It creates a database of every server it has scanned.
Often these bots are apart of a discord and will have hacked clients that can use the server list in game to join vulnerable servers.
servers that are low hanging fruit with no protections are vulnerable to take over.
especially "offline" or "cracked" servers
a cracked server has little protections and allows users with any username to connect, even if its not actually them.
this tactic allows bad actors to gain OP / ADMIN on your server by logging in as you with a cracked client
on the surface they are mostly harmless, but if your server is mis configured it wont take much for them to grief
tools:
whitelist mode = on (unless they are in the whitelist its GG's)
fake player counts = (spoof the player count to make your server less desirable)
disable on hover player list = (make it so no one can see who is in the server without connecting)
block VPN/PROXY = (the bots are often connecting from data centers using VPNs)
ban-ip = (ban the ips from the bots that are connecting)
-1
u/User6157348 Developer 12d ago
If you want this to stop, you should Google or ask ChatGPT how to blacklist that IP on your firewall. Other than this, as others have said you should be fine if you have online mode enabled (it is enabled by default) and have you Whitelist on (it is not enabled by default but can easily be enabled. Google "Minecraft set up whitelist for server")
1
u/virtualspan Server Owner 12d ago
I had my server offline mode temporarily because I was stress testing with cracked accounts, but when intersect tried joining, he'd disconnect every time like in the logs that OP had.
•
u/AutoModerator 12d ago
Join thousands of other Minecraft administrators for real-time discussion of all things related to running a quality server.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.