How to protect a Minecraft server from bot attacks

What a bot attack looks like

Attack tools for Minecraft are easy to find. They open hundreds or thousands of connections that look like players: they log in, sometimes chat or run commands, and leave. Typical signs:

• the number of joins jumps far above what the server normally sees;
• nicknames look generated: random letters, digits only, or one prefix with a counter like Lobby_1234;
• many connections come from the same subnet or the same network;
• the slots fill up and real players cannot get in;
• the console and the chat are flooded, the proxy starts to lag.

Some bots do not attack at all. They connect again and again to scan the server, collect the player list or check that it is online.

Why bots come through proxies

One computer has one address, and blocking a single address is trivial. That is why attacks are run through proxy lists: data center proxies, hacked devices and residential proxies, where the traffic goes through someone's home connection. Each bot gets its own address, and an IP ban on the proxy stops nothing.

So the question is less about a single bot and more about the networks they come from. This is what Kordon looks at.

How Kordon's attack mode works

Kordon knows how many players usually join your server. When the number of new addresses and nicknames suddenly goes far above that, and the connections share a network, a nickname pattern or the same client version, Kordon switches the server to attack mode. The panel shows «Bot attack in progress».

During an attack:

• the subnets the bots come from are closed on every server protected by Kordon, yours included;
• residential proxies are refused on every protection level;
• a server that is still in observe mode gets protection switched on automatically;
• checks made during the attack do not count toward your plan's daily limit.

A new player with a normal nickname from a different network is checked as usual and gets in. Your whitelist keeps working, so staff and regulars are never locked out.

Bots that keep coming back

Bots that connect again and again from the same network with similar nicknames, at a steady interval, are recognised as repeat bots. Kordon blocks them permanently on all its servers, so they stop using up your checks. In the login log such a bot takes one row with a counter instead of a thousand rows.

What else helps

• Keep your staff and regular players on the whitelist: they always get in, even during an attack.
• Use online mode if your server allows it. Bots then need real Minecraft accounts, which costs the attacker money.
• Keep the nickname rules on: by default only nicknames that Paper itself allows get in, and you can add your own patterns.
• If attacks keep coming from one country you never get players from, a country filter closes it for good.

Kordon handles the address side of an attack. It does not check what a player does inside the game, so it is not an anticheat.