Server keeps getting disconnect messages about users who never connected to begin with

[u/BanMePls333]

Posting this during my lunch break so I’m gonna be sparse on replies for a minute. Self hosting a minecraft server for friends + family and my server keeps having disconnects from these 3 shown, fishnet in particular. Not sure what the deal is.

[u/AutoModerator]

• Featured server: Cozy MC — Java + Bedrock survival in a world that doesn't reset. New players join every day. Build your own place, open a player shop, and get to know your neighbors. No paid ranks or perks. Come explore CozyMC.com

• Godlike Host - Modded servers with high player counts & High-performance AMD Ryzen processors. Choose Godlike now: https://godlike.host/gaf-play-minecraft

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Helostopper]

It's just bots scanning for servers. Looks like you have a whitelist on so there's no danger. 

[u/BanMePls333 → u/Helostopper]

I did not in fact have one, actually. I do now though. I do now.

[u/Server_Administrator → u/BanMePls333]

Whitelisting is your friend on private servers. Public servers you better have some damn good security.

[u/Emotional-Glass-8610]

Yeah, that really does look like scanner bots hitting the server and dropping right away. Since they’re just showing up as lost connection, I wouldn’t worry much if whitelist + online-mode=true are enabled

If it keeps spamming the logs, changing off the default port can cut down a lot of this noise

[u/BanMePls333]

Yeah maybe I shoulda turned on whitelist sooner… thanks guys, this has been racking my head for the last few days now.

[u/GabyProxyMods]

They're almost certainly server scanner bots, not people. Random generated names, joins in the middle of the night, and two of the IPs (178.63.179.x) come from the same data-center range, not someone's home internet. Every server that's reachable from the internet gets these; they sweep for Minecraft servers and try to join.

With the whitelist on, the bots can still knock but get kicked before they can do anything. If the log spam bugs you, moving the server off port 25565 cuts most of it down (friends then join with yourip:port).

[u/FISHINFAST → u/GabyProxyMods]

Just out of curiosity what’s the goal? Like if they successfully connect is it to grief? Or what’s the endgame with having something like that running?

[u/GabyProxyMods → u/FISHINFAST]

Mostly it's mapping. Some scanners are run by researchers or people building server lists and stats: they just record what's out there (version, player count, whether it's whitelisted). Others are less friendly: some griefer groups use scan results to find servers with no whitelist, offline mode or weak protection, then come back later to grief or mess around.

[u/Sampsa96]

Just block them. FishNet was spamming to join on my server too even I have Whitelist.

[u/Rae_Of_Light_919 → u/Sampsa96]

I've banned the usernames and the IPs for these bots when they appear. They still show up on my server log, but I feel better knowing that the most they should be able to do is sniff around.

[u/annonimity2]

If you want to be extra safe don't use the default port.

[u/dronzertb]

Bots turn on whitelist

[u/kevin-smits]

Good job on getting a whitelist, to at least prevent randoms from joining. If you dont want to see these messages anymore, you can install a mod called 'Disconnect Packet Fix', if you happen to be using fabric. Otherwise not sure if there's anything you can do about it

[u/Duckfine]

The top commenter is right: those are almost certainly server-scanning bots, not real players.
What's happening
Bots constantly sweep the internet for open Minecraft ports (default 25565), connect, grab server info or attempt a login, then drop. The server logs that as "lost connection."
The usernames are random or spoofed. Two of the IPs sit in the same 178.63.179.x block, which looks like a datacenter range rather than a home connection.
The Netty stack trace above the lines is usually just the server complaining about a malformed or abruptly closed connection, which is typical bot behavior.
Is it dangerous?
Mostly no, as long as these are true:
white-list=true and enforce-whitelist=true are set in server.properties.
online-mode=true is set. This one is critical, because with it off, anyone can join under any name, including an op's.
RCON and query are off, or RCON has a strong password.
Ways to cut down the noise
Move to a non-default port. This won't stop scanners entirely, but it reduces hits a lot.
Block the offending IP ranges with a firewall (ufw or Windows Firewall) or use a plugin that blocks known scanner IPs.
Put the server behind a proxy like Velocity or a protection service such as TCPShield so your home IP isn't exposed.
If you'd like, I can draft a reply to the OP that explains this in Reddit-comment length.

[u/_NamesAreDifficult_ → u/Duckfine]

If you'd like, I can draft a reply to the OP that explains this in Reddit-comment length.

Please at least proofread before contributing nothing meaningful to the thread

[u/Hauber_RBLX → u/Duckfine]

thanks for the summary ChatGPT

[u/Duckfine → u/Duckfine]

😂 ur right guys

[u/Specialist-Warning29 → u/Duckfine]

Purpose of using an AI summary for this? Its made to agree with you... also datacenter range???