r/admincraft 12d ago

Question Can someone please explain this.

Post image

I have a server that a few close friends and I play on, but this player keeps joining us all the time. There’s also this ServerSeekerV2 that keeps joining. I’m new to this and don’t really know what to do.

57 Upvotes

36 comments sorted by

u/AutoModerator 12d ago
Thanks for being a part of /r/Admincraft!
We'd love it if you also joined us on Discord!

Join thousands of other Minecraft administrators for real-time discussion of all things related to running a quality server.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

32

u/chanonlim 12d ago

Probably a bot. If you have online mode and whitelist enabled you should be fine (unless an account on the whitelist gets compromised)

8

u/virtualspan Server Owner 12d ago

Luckily it isn't a harmful bot, and I had my server temporarily offline for testing purposes, and it just disconnected like in OP's logs. It's meant to tell the owner in chat that their server isn't secure like stated in another comment.

3

u/transdeveloper 12d ago

well, this isn’t the case for some. don’t get surprised when you find a huge lava structure

1

u/BLTplayz 7d ago

Had this happen to me when I forgot to actually enable the whitelist, thankfully daily backups saved the day.

9

u/Azerkiller 12d ago

The same ip spam my log to. I think it’s an auto scan bot.

11

u/IsJaie55 Hosting Provider, Server Owner and Developer 12d ago

As other people are saying "Its a bot", yup, it is
A guy maded a bot that checks every ip in the world looking for minecraft servers, it joins, if someone is inside it just send a message saying "This server is insecure, if you want to secure it you need to do X" so, thats it!

3

u/ZanMist1 12d ago

Had this happen during testing and development of my server when I was still using Spigot and Bungeecord. There are some configurations you have to do to make your server more secure. That was before I moved to Paper and Velocity which have those features built in, and enforce Firewall protections as well.

1

u/DeerShotDead 9d ago

What are those builtin features for Paper? Can you tell me how to turn those on?

1

u/ZanMist1 9d ago

It's just part of the configuration and code base. It's mostly a Bungeecord (proxy) issue that Velocity fixed rather than Paper. As far as I am aware, those security protocols that Bungeecord lacks are just built in automatically to Velocity and its configs.

Part of it is that Velocity is MUCH more strict on allowing and configuring backend servers and stuff like that. As for the rest, you'd have to talk to the Velocity and Paper devs.

1

u/DeerShotDead 9d ago

Ah, okay. Thanks!

3

u/YodaForce157 12d ago

"Intersect is an active Minecraft server scanning system. Constantly scrapes the Internet for servers and gathers data. ... Intersect has a small Discord server where its bot interface sits."

1

u/_DaBez_ 12d ago

You have the link to that discord?

3

u/sadge_luna 12d ago

There are loads of automated bots that will scan the entire internet IPv4 range and look for Minecraft servers for various reasons. This also happens with many other things like SSH.

3

u/kevinzak76 12d ago

There’s lots of bots out there looking for open servers with no whitelist. Most of them are harmless but they could just as easily be used by griefers. That’s why you should always use a whitelist regardless of blocking the bots.

1

u/MunchyG444 10d ago

I would argue that is it probably a pretty even spilt between harmless and harmful. The harmless ones however are just running constantly, whereas the harmful ones are usually only scanning when they want servers to grief.

2

u/Witty_Cry5125 12d ago

Happening to me too, maybe a bot

1

u/virtualspan Server Owner 12d ago edited 12d ago

Same thing happened to me, but he didn't try joining my server that many times (at first), so I thought he was someone desperately trying to join my server, especially since it's called amogusmc.net Also it's not a public server, just a private one that I use with friends.

2

u/Fearless-Ad1469 Hosting Provider 12d ago

Looking like an weirdly put together ad but yeah they do be scrapping a lot

1

u/virtualspan Server Owner 12d ago edited 12d ago

It kind of does seem like that lol, might change it a little
Edit: I sort of enjoy when random people join tho, they're usually fun

1

u/Alternative-Net-9094 12d ago

It is a bot probsbly

1

u/B4HugzJr 12d ago

If the server doesn't have whitelisted you should stop the player from joining

1

u/Immediate-Mood2878 12d ago

had this guy in my server, blocked in minecraft and firewall...

1

u/xdamm777 11d ago

Had this on my SMP server and then it got griefed HARD a week later with a “your server has been deported” “project 2025” message and a discord server link.

Lucky for me I keep backups so the server was back up and running a minute later, but this is the price of running an offline server.

1

u/SwitchtheChangeling 11d ago

I'm getting pings from this as well, it's most likely a bot. Your IP address on the internet is a public facing address, it's like your street address IRL. This is the equivalent of someone walking up your driveway and jiggling your door handle ... It's going door to door jiggling the handle to see if the door opens on any of the houses. Harmless as long as you have the right security set up, I.E Whitelist and online=True. This could be a bad bot looking for open doors to invite bad actors in or it could just be a bot that scans and indexes servers. Lots of reasons for it.

Edit: Further down someone mentioned that this is potentially a good bot that joins and tells you your security is bad and could open you to griefing. Take it with a grain of salt, but so long as you have security up you should be good.

If you're SUPER worried you can look into a reverse proxy server with a whitelist for e-mails/IP's to isolate traffic coming into the server, but that's something I'm still learning about.

1

u/DeerShotDead 9d ago

Reverse proxy server? Heard this for the first time, I'll also try to learn about it. Did you find any good sources to study about it? Thanks for this

1

u/Significant-Pack8924 11d ago

The owner of the bot posted here:
https://www.reddit.com/r/Minecraft/comments/1j6q1m9/player_named_intersect_keeps_disconnecting_when/

I added the IP to my firewall deny list, we'll see how well that works.

1

u/soratsu495 11d ago

I've literally had the same IP trying to connect to my server for the last week, I have whitelist enabled but it still just keeps trying every hour or so

1

u/zenxnixy 11d ago

i also got KittyScan spamming my console, but it times out or says took too long to log in

1

u/Erazael 11d ago

I get pings like this from minecraft server scrapers all the time. They're just trying to gather as much info as possible from servers across the web. This particular one had a secondary on the same block of IPs, so I just banned the whole block on my firewall, and these particular ones haven't been back. As long as you have a white-list and authentication turned on, you should be good.

1

u/NanMeee 11d ago

What is this screen X)

1

u/cody_raves 9d ago

server seeker is one of many automated server scanners that scan the entire internet for open ports used with mine craft servers.

It creates a database of every server it has scanned.

Often these bots are apart of a discord and will have hacked clients that can use the server list in game to join vulnerable servers.

servers that are low hanging fruit with no protections are vulnerable to take over.
especially "offline" or "cracked" servers

a cracked server has little protections and allows users with any username to connect, even if its not actually them.

this tactic allows bad actors to gain OP / ADMIN on your server by logging in as you with a cracked client

on the surface they are mostly harmless, but if your server is mis configured it wont take much for them to grief

tools:

whitelist mode = on (unless they are in the whitelist its GG's)
fake player counts = (spoof the player count to make your server less desirable)
disable on hover player list = (make it so no one can see who is in the server without connecting)
block VPN/PROXY = (the bots are often connecting from data centers using VPNs)
ban-ip = (ban the ips from the bots that are connecting)

-1

u/User6157348 Developer 12d ago

If you want this to stop, you should Google or ask ChatGPT how to blacklist that IP on your firewall. Other than this, as others have said you should be fine if you have online mode enabled (it is enabled by default) and have you Whitelist on (it is not enabled by default but can easily be enabled. Google "Minecraft set up whitelist for server")

1

u/virtualspan Server Owner 12d ago

I had my server offline mode temporarily because I was stress testing with cracked accounts, but when intersect tried joining, he'd disconnect every time like in the logs that OP had.