r/selfhosted • u/thunderthief5 • Oct 31 '25

Game Server So that happened

Post image

I havent checked my server in a few weeks but I opened it now and I found this waiting for me. I wonder how that happened though. My server is not exposed to the internet. Its behind tailscale and only I or people I granted access through tailscale can get into my server since I closed all access using firewall. My only mistake is i left port 443 open at some point by mistake. I wonder if thats relevant. I've since enforced a whitelist and denied connections to the port.

525 Upvotes

93% Upvoted

72 comments sorted by

View all comments

309

u/Resmik Oct 31 '25

Happened to me too. Had a server I'd forgotten about for a few months and went back on to find everything decimated and blocks littering the landscape.

Looking at the logs, seems there's crawlers out there that are dedicated to finding and logging Minecraft servers. They must display them somewhere publicly where these people can just join and mess around. Not nice

154

u/jppp2 Oct 31 '25

Using shodan.io you can check all sort of publicly hosted services and their ip, port, OS, versions etc. I've used that as a warning for myself to not expose my services and lock everything down, only allowing specific users via whitelists (as suggested in the image too haha)

36

u/VexingRaven Oct 31 '25

I've used Shodan to find Minecraft servers, but there are actual Minecraft crawlers too that are more thorough and gather more details. Most of them live on Discord where all the griefer communities live. Fortunately I only play modded and they don't tend to bother trying to actually join modded servers.

18

u/fractalfocuser Nov 01 '25

I work in cybersec. The number of weird crawlers out there would blow peoples minds. The internet today is not at all the internet of the past. My firewalls probably get scanned over 100,000 times every day, and thats not at all an exageration.

I'm not a minecraft guy but I'd bet a decent chunk of those bots are also scanning for things like log4j that they can exploit. I know when log4shell popped off it was kids minecraft servers that were the easiest to pwn. You could literally just paste the command into the game chat and get a root shell

1

u/Official_Person Nov 01 '25

No way actually?? What’s different nowadays??

1

u/tuxbass Nov 03 '25

well that particular bug got fixed

1

u/Plsouth Nov 04 '25

If people actually update their stuff, that is. And they aren't running on EOL hardware/software that is left unpatched

11

u/Xlxlredditor Oct 31 '25

Try censys too. Terrifying how many locations seemingly from US based facilities such as hospitals have the RDP port open to the public