Minecraft Forums

Very soon after posting my Minecraft server to r/mcservers, I was hit with what only can be described as a botnet spam attack.

My server was flooded with over 100 different logins, all from different IPs, within a very brief period. The server is set to "online" mode, so all of these had to be actual minecraft.net accounts (obviously hacked). They then proceeded to spam the crap out of my server chat.

They all had the same message:
"-- Reddit look at youtube.com/ccf3anz"

The entire server log of the spam attack can be found HERE.

The organizer of the attack is apparently either this guy, as seen by the message right before the attack:

[NAMES REDACTED PER FORUM RULES]


Has anyone seen anything like this before? Just figured I'd post this to give everyone a heads up as to the new level of griefing/attacking going on in the MC 1.8 world.

edit: since then, I have added spam filters to my server and am considering an universal blacklist application. Oh, and I have removed my reddit server listing as apparently they are targets.

this type of attack is known as a DDOS, it floods the server with messages in order to crash a server. normally it's on a targeted server, but in this case it wasen't.

Quote from link145632

this type of attack is known as a DDOS, it floods the server with messages in order to crash a server. normally it's on a targeted server, but in this case it wasen't.

I wouldn't necessarily classify it as DDOS per-say as spamming text in chat really will not cause a server outage (well I guess you can classify chat as a 'service' inside of a MC server...lets not split hairs here. DDOS generally focuses on flooding the server (usually network level or resource request level) to the point where it denies service. More like a targeted spam botnet.

I just didn't realize that people have created this type of MC botnet and found it curious to say the least.

Quote from webrosc

just one of the downsides of posting your server on a site that full of immature idiots :sad.gif:

btw, you should remove names, naming and shaming isn't allowed on here

I generally like Reddit, it has a wide enough audience that you'll see all types on there.

I redacted the names to protect the guilty if those are forum rules. Although I would hate to think that I'm defaming someone, because this is obviously a malicious attack warning and I figured other admins would like the accounts to add to their blacklists.

Not hacked accounts necessarily. It's just DDoS sending a lot of requests to your server and lagging it. It's probably just a troll, don't worry about it. They're probably just using a booter or something; it'll stop soon.

Most servers learned a long time ago not to post on reddit. It is the number one rule of advertising your server. It has been like this since I started my server in 1.2 and probably before. Any server affiliated with reddit even if it is just a post on their site is an instant target for greifers. Most of them are avo fanboys.

Quote from fearless1333

Not hacked accounts necessarily.

My server is in online mode. In order to connect, you have to pass verification through minecraft.net. Around 50+ account were involved in this attack. So all those controlled accounts (see pastebin serverlogs) had to be verfied through minecraft.net. I couldn't see someone paying 50 x $15-20US just to set up a network of accounts to use in this fashion.

Quote from webrosc

you could always goto mcbans.com (think its .com) and add them there, thats the only real greifer/spammer list there is.

I'm definitely adding this plugin (as soon I can recover my old mcban.com server registration info from 6-12 months ago when I hosted this last.)

Quote from ianm56

Most servers learned a long time ago not to post on reddit.

Learned my lesson. Just trying to advertise to gain a player base. Haven't hosted in 6 months, just popped it back online this weekend and need some players.

Quote from fearless1333

It's probably just a troll, don't worry about it. They're probably just using a booter or something; it'll stop soon.

I banned all accounts involved, so it stopped after that (think I got the master account in the operation).