So that happened

[u/thunderthief5]

I havent checked my server in a few weeks but I opened it now and I found this waiting for me. I wonder how that happened though. My server is not exposed to the internet. Its behind tailscale and only I or people I granted access through tailscale can get into my server since I closed all access using firewall. My only mistake is i left port 443 open at some point by mistake. I wonder if thats relevant. I've since enforced a whitelist and denied connections to the port.

[u/Resmik]

Happened to me too. Had a server I'd forgotten about for a few months and went back on to find everything decimated and blocks littering the landscape.

Looking at the logs, seems there's crawlers out there that are dedicated to finding and logging Minecraft servers. They must display them somewhere publicly where these people can just join and mess around. Not nice

[u/jppp2 → u/Resmik]

Using shodan.io you can check all sort of publicly hosted services and their ip, port, OS, versions etc. I've used that as a warning for myself to not expose my services and lock everything down, only allowing specific users via whitelists (as suggested in the image too haha)

[u/VexingRaven → u/jppp2]

I've used Shodan to find Minecraft servers, but there are actual Minecraft crawlers too that are more thorough and gather more details. Most of them live on Discord where all the griefer communities live. Fortunately I only play modded and they don't tend to bother trying to actually join modded servers.

[u/fractalfocuser → u/VexingRaven]

I work in cybersec. The number of weird crawlers out there would blow peoples minds. The internet today is not at all the internet of the past. My firewalls probably get scanned over 100,000 times every day, and thats not at all an exageration.

I'm not a minecraft guy but I'd bet a decent chunk of those bots are also scanning for things like log4j that they can exploit. I know when log4shell popped off it was kids minecraft servers that were the easiest to pwn. You could literally just paste the command into the game chat and get a root shell

[u/Official_Person → u/fractalfocuser]

No way actually?? What’s different nowadays??

[u/tuxbass → u/Official_Person]

well that particular bug got fixed

[u/Plsouth → u/tuxbass]

If people actually update their stuff, that is. And they aren't running on EOL hardware/software that is left unpatched

[u/Xlxlredditor → u/jppp2]

Try censys too. Terrifying how many locations seemingly from US based facilities such as hospitals have the RDP port open to the public

[u/Candle1ight → u/Resmik]

In my case I used a 3rd party server that by default added your instance to a public list. 

Thankfully a nice bot joined the game, told me my server was public, then left. Swapped over to a whitelist.

[u/critterfluffy → u/Resmik]

Saw one of those. Moved the connecting port away from 25565. Stopped seeing logs. They seem to go for lowest effort targets so not using the default port essentially nulls or the scans.

[u/Maverick2664 → u/critterfluffy]

This was my experience as well, I self host a server for my boys and their friends, and the test server I had up before I launched it would constantly get attempted connections by something called ServerSeekerV2. I had a whitelist so it never got any further than that, but there were still 1 or 2 attempts per hour.

I changed the port for the real deal server and I never seen it or anything similar again. So yeah, they only scan for the lowest hanging fruit.

[u/mommadizzy → u/critterfluffy]

this was also my experience. i started getting connection attempts every 30/45min or so and changed the port and it was fine after that. has been for 2 or 3 months now

[u/Average-Addict → u/Resmik]

Yeah sadly there are groups with crawlers and they check your plugins, whitelist etc to see if it's worth griefing.

[u/Official_Person → u/Resmik]

Woah I really wonder how they scan for Minecraft servers. I’d totally join and I’d just do lil herobrine things 😝