Introduction
If you’re seeing rapid-fire connection attempts in your server console from names you don’t recognize, you’re likely dealing with server scanners. These are automated bots that ping Minecraft servers to gather data or spam ads. They don’t actually join (they aren’t real accounts), but they can fill your console with noise. Here’s what they are and what we’ve done about them.
What are Minecraft Server Scanners
Minecraft Server Scanners are automated bots that attempt to connect to Minecraft servers. Their main goal is to send requests to servers which result in a message being displayed in the server’s console. These bots do not join the server as they aren’t real accounts, which allows them to spam requests at a rapid pace. These bots primarily gather statistics, spam, and in some cases, advertise. While these bots are generally harmless in terms of gameplay, they can cause annoyance and concern for server administrators due to the constant spam messages they generate in the server console.
Known Server Scanners
It’s important to be aware of the known server scanners to better understand their impact on your server.
Below is a list of known server scanners, along with their IP addresses:
| Name | IP | Notes |
|---|---|---|
| shepan | 132.145.71.44 | Self-described as “Spying on Minecraft Servers” |
| ServerOverflow | 149.102.143.151 | |
| pfcloud | 45.128.232.206 | Primarily used for spam |
| pfclown | 193.35.18.105 & 193.35.18.163 | Scanner operating from two IPs |
| ThisIsARobbery | 193.35.18.92 | |
| notschesser | 193.35.18.92 | |
| FifthColumnMC, dscrdGGfabricmc, .ifthColumnMC, joinOurDiscord | 103.136.147.26, 103.216.220.39, 103.75.11.55, 198.54.134.173, & 146.70.200.24 | Spam Advertising using Login Attempts & Potential risk of scanning for insecure servers. |
Blocking Server Scanners: Our Approach
We null route (drop all traffic from) the IP addresses of known server scanners at our Chicago nodes. If your server is hosted there, these scanners can’t reach it at all - no action needed on your end. We’re working on extending these blocks to our other locations (UK, Germany, Australia, Finland, and France).
The IP addresses we have null routed are shown to the left.
| IP |
|---|
| 132.145.71.44 |
| 149.102.143.151 |
| 193.35.18.0/24 |
| 45.128.232.206 |
| 103.216.220.39 |
| 103.136.147.26 |
| 103.75.11.55 |
| 45.128.232.206 |
| 198.54.134.173 |
| 146.70.200.24 |
With this action, we have effectively blocked these scanners from attempting to connect to your server when hosted on our Chicago nodes. This means that you, as a server administrator, won’t need to take any further action to block these IP addresses.
Reporting New Scanners
If you spot new scanner IPs spamming your console, let us know through a support ticket so we can add them to the block list. If one of our null routes is causing issues for your server (blocking something it shouldn’t), reach out and we’ll look into it.