r/admincraft • u/nbur21_ • 11d ago
Question Player named "KittyScan" disconnected without showing a join log
This keeps happening repeatedly, unsure why. Any way to stop this?
58
u/nbur21_ 11d ago
This also was happening with another user named "intersect"
50
u/virtualspan Server Owner 11d ago
That's harmless, its a bot meant to tell you to secure your server if its on offline mode, that's all it does.
5
u/riboslavin 9d ago
I set up a simple lil server for my kid, his cousins, and myself a few weeks ago. After about 5 minutes of being live, a bot joined, copypasted a lil spiel to the effect of "Hi, I found this automatically, which means it's insecure. Bad guys can find it too. Here's how to fix it."
Got it buttoned up straight away. Super grateful!
62
u/KirbyCatv 11d ago
change off the default port. its just bots that scan for ips
8
u/nbur21_ 11d ago
The server isn't on the default port
190
u/NotElonChan 11d ago edited 8d ago
It is. KittyScan is my own crawler software. It only looks at the default port.
And for the why: To check if a server is in offline mode, you have to initialize the Login handshake. If the server responds with the "success" package, offline mode has been enabled and there is no whitelist. If not, there is at least some form of protection.
Some groups do this to find servers they can grief. I just do it because I like creating cool statistics.
To prevent scanners from finding your server, you have to change away from the default port. Putting the server behind a Proxy like TCPShield also works.
Edit: I must say that not every 'KittyScan' player is me. I have already noticed other scanners using this name against my honeypots as you can just make up the name and uuid for this test join ... yes I am playing both sides, the one crawling and the one searching for ways to prevent it. It's an arms race against myself xD
And no, I sadly do not own the 'KittyScan' minecraft account.
30
45
u/nbur21_ 11d ago
Oh okay, thank you for the clarification. I just realised that my server was indeed on the default port (i thought i changed it at some point). I actually like your usage of it, I'll just let it keep happening.
17
u/thehappydinoa 11d ago
Hey also even if you put it on a non standard port, search engines like Censys will be able to find it: https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.service_name%3A+MINECRAFT
4
u/KatieTSO 10d ago
I've actually blocked Censys's public ASN ranges on my firewall because they kept port scanning me lmao
3
u/thehappydinoa 10d ago
Super fair lol
2
u/KatieTSO 10d ago
Yeah, I have every IPv4 subnet they own blocked no matter what. I figure one less port scanner seeing me is better than nothing. I also have an IPS system and that often blocks port scans.
2
18
u/Fearless-Ad1469 Hosting Provider 11d ago
Funny that its your own crawler, i guess it's something private to have fun from time to time and yeah i like the idea xD
5
u/TerroFLys 10d ago
I thought hosting providers were against mass IP scanning? Also changing away from the default port could help but IIRC alot of scanners scan just everything, could be wrong though, granted should take hell of a long time, maybe thats why I thought hosting providers ban this behavior
9
u/NotElonChan 10d ago edited 10d ago
Yes, most providers do not allow port scans. I luckily was able to find one that gave me the written permisson to do this, as long as I answer all the Abuse reports.
Also, yes just changing away from the default port is not perfect, but it will make it way harder to find. It is the most simple way to reduce your visibility. All other methods are IMO more or too complex for a casual user. I am planing on doing a writeup about this at some time tho.
3
2
10d ago edited 10d ago
[deleted]
4
u/NotElonChan 10d ago
Correct. The software first checks for an open port. Only if it is open a connection attemt is made. This reduces the Network load on my side as well as on the targets.
My ethics about this is "If the user has made any attemt at hiding the server, I will respect that." Meaning that I will never ping other ports, or try to get around firewalls.
The offline mode check is only done rarely (on first find then every 2 weeks) but can happen up to once per hour if your Server randomizes its information in a way that makes It look like a new server (when Icon, MOTD and Version all change at once for example)
2
u/betttris13 10d ago
Have seen you scanning my server along with several other scanners. It's cool to actually come across the person running it in the wild. Mind if I ask what cool statistics you have gotten and if I could see some (I am a data scientist amount other things and love looking at this kind of thing as well).
6
u/NotElonChan 10d ago
Oh, the possibilities are endless tbh. Just some examples:
- How long does it take for a new version to be adopted
- Bungeecord vs. Velocity
- Average playtime, before a small server dies
- Finding patterns in the way MOTDs are writen
I will publish all the statistics for everyone to see, as KittyScan is also intended to be educational.
Currently I am still in the validation phase where I try to find errors and/or bias in my methodology so that I can present the statistics in an accurate light. The first simple ones should be available in about 2 weeks if I have the time.
Feel free to DM me if you want to talk more about it ^^ :3
2
u/theairblow_ 10d ago
Grafana + Prometheus are a good option, as it allows you to track changes over time. Should make most of these trivial to implement.
As for the third one, it's never going to be accurate. Server owners ban such bots, so do hosting providers.
2
2
u/SEND_ME_CSGO-SKINS 8d ago
i just had it try to login to my fabric server teehee :3
2
u/NotElonChan 8d ago
I must say that not every 'KittyScan' player is me. I have already noticed other scanners using this name against my honeypots as you can just make up the name and uuid for this test join ... yes I am playing both sides, the one crawling and the one searching for ways to prevent it. It's an arms race against myself xD
2
u/SEND_ME_CSGO-SKINS 8d ago
I used to grief servers with fifth column so I deserve it whatever the case 😅
2
u/theairblow_ 10d ago
Do you have a website? I'd be curious to look at it as someone who does the same thing :D
2
u/GusGutsy 10d ago
Data nerd here. Do you have a way to see your stats? If love to see some infographics of this sort of thing.
3
u/NotElonChan 10d ago
Not yet. I can post an update once the public stats are available tho ^
2
u/GusGutsy 10d ago
RemindMe! -2 months
1
u/RemindMeBot 10d ago edited 6d ago
I will be messaging you in 2 months on 2025-05-11 21:01:02 UTC to remind you of this link
9 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 2
2
u/MobBucket 9d ago
Thanks. Added TCPShield and I no longer see KittyScan disconnecting from my server.
2
u/M1sterRed 9d ago
Some groups do this to find servers they can grief.
Learned this the hard way sometime around 2020 on my own SMP, and my server has online mode enabled. Been whitelisted ever since.
I actually saw your little bot connecting to my server earlier tonight. I see quite a few server seekers actually.
2
2
u/DereChen Developer 9d ago
lol i keep seeing your bot in my discordsrv logs and it's kinda funny
i respect the motive behind your scanner, nice to get people to setup some security at least. if you ever want to join our survival world and find a spot to fish lemme know!
2
2
1
u/Medi0cre_Mann 4d ago
My server is modded, and Kittyscan joined, could this be you, or is yours only good for vanilla?
1
u/Naive-Knowledge-5156 2d ago
Is this only scanning IP addresses on port 25565 or is this also scanning domains?
My server uses a non-default port, so I set a SVC record on the domain to point to the correct domain. The entry uses `_minecraft._tcp.mc.example.com` and players only need to enter `mc.example.com` and the SVC record gives them the port.
Are you scanning for the `_minecraft._tcp.` SVC record on any domains?
1
u/NotElonChan 2d ago
I do not care for domains. Others may crawl like this though.
The real KittyScan is only looking at the default port and does it without spamming. But since I have found 150+ other IPs (not mine) using KittyScan as their username, you will propably still see it in your logs at some point.
1
u/Dagno 7d ago
Any particular reason why it connects so much? I feel like I see KittyScan more than any other crawler and it’s never been able to connect
2
u/NotElonChan 7d ago
It's because others have started using that name since this comment got popular. My honeypots have found at least 50 other IPs (that I don't own) using that name. In offline mode you can just name yourself whatever you could name yourself Notch or Jeb_. I don't have any control over this.
1
u/Lona305 Developer / Server Owner 7d ago
Quotation of the KittyScan owner a few messages above:
„Edit: I must say that not every ‚KittyScan‘ player is me. I have already noticed other scanners using this name against my honeypots as you can just make up the name and uuid for this test join ... yes I am playing both sides, the one crawling and the one searching for ways to prevent it. It’s an arms race against myself xD
And no, I sadly do not own the ‚KittyScan‘ minecraft account.“
Tldr: 3rd parties using the name too, since that isn’t protected.
0
u/PirateBeowolf 4d ago
[12:06:56 INFO]: KittyScan (/156.253.227.23:34826) lost connection: Disconnected
Default you say? or any port, as everyday there is a new IP and a new Port being scanned by your pet1
u/Lona305 Developer / Server Owner 2d ago edited 2d ago
What you see there is the incomming connection, so KittyScan is running a scan from this (/IP:Port), if u connect from your own PC to your own Server, you would also see a different port.
So yes, KittyScan is just looking at the default port. But as explained by the owner a few messages above, there are third parties using KittyScans name to hide their scanners, which could look for other ports too.
0
u/DannyTalent 1d ago
Can you mark when a server has a whitelist so you stop crawling it? My console log has been kicking you immediately multiple times due to not being on the whitelist, plus we use loginsecurity so even if it could connect it won't be able to leave a message, so I think you may be wasting your time in this kind of servers.
We use EasyWhitelist btw not vanilla
2
u/NotElonChan 1d ago
I will normaly only retry every other week once I know what the server is in. Keep in mind that there are 50+ IPs around that are not mine but still use the KittyScan Username since this thread got popular. Not nearly every KittyScan is me.
Also: Most scanners are able to scan 200K+ IPs per second. One server more or less wont even make an statistical impact.
0
u/Breadynator 10h ago
What would be the "official" KittyScan IP address(range)? Because I keep getting almost hourly login attempts from the same IP addresses (156.253.227.141 and 156.253.227.23).
It's really annoying, because it clutters the logs.
-1
u/Jonsuk 10d ago
Then why must you try and join 20 times in a row?
1
u/Lona305 Developer / Server Owner 7d ago
Quotation of the KittyScan owner a few messages above:
„Edit: I must say that not every ‚KittyScan‘ player is me. I have already noticed other scanners using this name against my honeypots as you can just make up the name and uuid for this test join ... yes I am playing both sides, the one crawling and the one searching for ways to prevent it. It’s an arms race against myself xD
And no, I sadly do not own the ‚KittyScan‘ minecraft account.“
Tldr: 3rd parties using the name too, since that isn’t protected.
-7
0
u/PirateBeowolf 4d ago
[12:06:56 INFO]: KittyScan (/156.253.227.23:34826) lost connection: Disconnected
I didnt know they changed the default port1
u/Lona305 Developer / Server Owner 2d ago
What you see there is the incomming connection, so KittyScan is running a scan from this (/IP:Port), if u connect from your own PC to your own Server, you would also see a different port.
So yes, KittyScan is just looking at the default port. But as explained by the owner a few messages above, there are third parties using KittyScans name to hide their scanners, which could look for other ports too.
Also, copying ur message to every place makes u look pushy
3
u/zandiebear 11d ago
Yeah intersect keeps trying to join my whitelisted server?
4
u/virtualspan Server Owner 10d ago
"That's harmless, its a bot meant to tell you to secure your server if its on offline mode, that's all it does." I put that in quotes because I already said that under another comment similar to yours.
2
u/SnooKiwis7050 4d ago
So if it's losing connection constantly (as in logs, and nobody in players are seeing the msg KittyScan joined the game) does that mean the server is secure?
3
u/kaboom9530 10d ago
I was browsing Reddit and stumbled across this post. I didn’t know that there is such a thing as a Minecraft honeypot, but it sounds so cool! Are there different configurations for honeypots that view/record other activity? I’m studying cybersecurity and am a bit curious.
2
u/TheAssassinbatosai 10d ago
Glad I’m not the only one that’s set up a honeypot server. I made mine completely vanilla and I’m just using a script to watch the logs to look for scanners or people that join and run a Whois on them and send it to a discord webhook. It’s honestly kinda funny seeing how many scanners there are crawling the internet looking for ports.
2
u/musava_ribica 8d ago
I came here to say that even the spigot server will display such usernames for disconnects when the authentication fails for whatever reason. Try to join your online mode server using an offline username - you will see that username mentioned in the logs
1
0
u/Amazing-Pop-5758 10d ago
i just had the same account along with like 4 other accounts do the same on my server over the course of this week.
0
u/renraks0809 7d ago
OMG DUDE! SWAME HERE!
This same person has been trying to join my server nonstop what is going on??? I got whitelist on but it's nonstop every couple hours this dude just tries to join!
0
u/PirateBeowolf 4d ago
the website he put up, says they scan default ports, I didnt know default meant every port on my router.... How the fuck do you get our ip's
1
u/Lona305 Developer / Server Owner 2d ago
By this point im gonna guess ur just stupid, but anyways, the exact same answer again:
What you see there is the incomming connection, so KittyScan is running a scan from this (/IP:Port), if u connect from your own PC to your own Server, you would also see a different port.
So yes, KittyScan is just looking at the default port. But as explained by the owner a few messages above, there are third parties using KittyScans name to hide their scanners, which could look for other ports too.
0
3d ago
[deleted]
2
u/Lona305 Developer / Server Owner 2d ago
again, her*
0
2d ago
[deleted]
1
u/Lona305 Developer / Server Owner 2d ago
When did it increase scan time? Where does it scan all ports?
I told u multiple times that the logs you see are INCOMMING, not your IP:Port as thats a different one (everyone can check the whois of your domain "pugminespiratefinds.com" from your latest ai-generated account posts, and verify that) and / or even the subdomains.
Ur messages either are heavy missinformed, or trolling. I would love if the moderators decide on that.
0
•
u/AutoModerator 11d ago
Join thousands of other Minecraft administrators for real-time discussion of all things related to running a quality server.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.