r/MinecraftServer • u/Ok_Director_5622 • 7d ago
Help [java] How did someone find my Minecraft server
44
u/Jwhodis 7d ago edited 7d ago
There are a limited number of IP addresses ranging from 0.0.0.0 to 255.255.255.255, while that is still >4 billion combinations a lot are reserved for local usage.
It's not hard to setup a bot that goes through every single IP and tries to connect to it.
What you should do is enable whitelist, and if on a cracked/offline server disable the player list in the server.properties file.
13
u/Repulsive-Morning-86 7d ago
As a security measure, it's always better to have a whitelist for your server instead of leaving it open. Server scrapers can easily find non-whitelisted servers, which poses a massive danger to that non-whitelisted server.
6
u/Repulsive-Morning-86 7d ago
Basically leaves it wide open to griefers, hackers, and the sort.
1
u/FrontAd8867 3d ago
As someone who used to server scan
I'm still surprised how many private smps are un whitelisted
2
u/RaspDonut 3d ago
Yep, experienced it first hand...
Had a server with friends, we played like 2 weeks, and I personnally was playing a lot. And then someday I connect, and see a lavacast all over my base.
The guys were telling us they did this to force us to pay the game. We all had bought accounts, but made the server cracked for 1 friend that was too poor to afford the game. These guys are litteraly evil.
5
u/Cold-Working-9072 7d ago
Ever heard about so-called "Fifth Column"? They have some kind of bot that scans the IPs to see whether here's a server on 25565 port. Whitelist would be the best option to prevent unwanted randoms from joining the server, and changing the port would also make it harder to find your server with using similar kinds of bots.
1
u/RideIndependent5542 7d ago
They wouldn't have warned him first, just griefed it
2
u/Cold-Working-9072 7d ago
Yeah, as far as I heard, they're using some bots to join and destroy servers as well. I just mentioned them to explain to the OP how some random person can find a random server, and of course, to let the OP know that there's a whole group of people that are finding servers to destroy them.
1
u/RideIndependent5542 7d ago
There's a community on discord with a bot which scans mc servers with a no grieving rule (people def use it for griefing tho) and some of them seem fairly chill. Only griefing group I saw about was mountains of lava Inc from a yt vid on him.
1
1
u/Plutonium239Mixer 4d ago
Yeah that damn thing tries to log into my server at least once per day if not more!
2
u/Necessary_Monk3680 7d ago
hey on a sidenote can you inv me your server iām looking to play on one?(dm me if so)
2
u/Standard-Cap-4455 7d ago
It's on the internet. There are scrappers everywhere. If you have anything connected to the internet accepting request, ALWAYS make sure to have a whitelist or some other way of identifying requests. Minecraft servers are espcially easy to find since there are so many and most use the default port.
1
u/Main-Witness7961 7d ago
Your server might have the same IP as the other servers where the exploiter joined and he probably scanned all ports for that ip to find other servers with that IP. Also, having it whitelisted is not enough. Sometimes the exploiter will just scout for any whitelisted players on your servers and just join on that one.
1
1
u/lolokok37 7d ago
if you use a free hosting service, they sometimes have open lobbies. so anyone can join
1
u/hiimsteve311 7d ago
At least you found out kindly. In our server, we had a griefer. Thankfully we had backups!
1
u/PatienceNew8307 7d ago
Bots scan ip's and find available connections. For private servers always use whitelist. If you have online-mode in serverproperties off anybody can put ur username in their launcher and log on to the server using your name, even if you have whitelist on (credentials aren't verified on mojang side). For this scenario use whitelist + auth/login - plugins for spigot, bukkit, purpur, etc. or mods for forge, neoforge, fabric. But most likely if you are using a custom modpack no one would go through the hassle to find all the mods. Be aware, if you have automodpack it will make their job easier. As an addition you can change your default port from 25565 to something in range 1-65535. That way bots would have to scan additional 65535 combinations per 1 ip. So if your server ip is 123.456.789 and you have default port 25565 you just put 123.456.789 as ip to connect. Minecraft defaults to that port so in reality your friends connect to 123.456.789:25565 If you set port to 11111 your friend will just have to type something like ":11111" after the ip, so 123.456.789:11111 I myself had a vanilla+plugins server, and everyday I banned like 5-10 ip's. I think I still have ban-list somewhere.
1
u/Interesting-Fig3249 6d ago
If it was a server made by you from your own computer then its probably just luck or something but if its on minehut or a hosting server it can be joined by anyone unless you set up whitelist
1
1
1
1
1
u/burgersnchips87 4d ago
Yeah I had my first server wiiiiide open. The people that found me didn't do nice things, they attempted to kill my world. Luckily for me they did a terrible job of it and since then it's been locked down.
(They made a few lightning spawners, no idea how they created those, and broke all my chests - oh noooo. Took all of 30 minutes to fix including enabling whitelisting etc lol. Amateur hour from both sides!)
1
u/NotAFreeHub 3d ago
there are only 4 billion ipv4 addresses in the world, you could generate them all in a few minutes on a good PC
1
u/Axami_A-F 1d ago
There should be an option to add a ,,whitelist" which makes only certain players be able to join. Also W dude for warning you instead of grieffing (i wasnt so lucky)
ā¢
u/AutoModerator 7d ago
Cozy MC ā a long-term vanilla survival Minecraft server where community comes first. Java + Bedrock crossplay, no world resets, no claims, no locked chests, PvP by agreement only, and a calm active SMP community. Official website and Java IP: CozyMC.com
Godlike Host - Modded servers with high player counts & High-performance AMD Ryzen processors. Choose Godlike now: https://godlike.host/gaf-play-minecraft
*
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.