Bot attack on a Minecraft server: what to do right now

Bots or DDoS

In a bot attack the connections reach the server: the login log shows hundreds of new nicknames, the slots are full, the chat and the console are flooded. In a DDoS the server is simply unreachable or everyone has a huge ping, the login log shows almost no new joins, and your host sees a spike in traffic.

DDoS is stopped by your host or by network protection in front of the server; Kordon does not filter traffic. Everything else in this guide is about bot attacks.

The first minutes

1. Open "Overview" in the panel. If Kordon has noticed the attack, it already shows "Bot attack in progress". While the attack lasts the server is protected, even if it was in observe mode.
2. Check that staff and your most active players are on the whitelist. The attack signs are not applied to players the server already let in before the attack, but the whitelist is safer: it always lets people in.
3. Open the login log (from the Basic plan) and look at the bots: their nicknames, countries and client versions.
4. If bots still get through, switch the protection level to "Strict".
5. Add a "Not allowed in nickname" rule with the bots' pattern, for example ^lobby_[0-9]+$ (from the Basic plan).
6. If bots come from countries where you have no players, close those countries with the filter for as long as the attack lasts (from the Basic plan).
7. If all the bots share one client version and your players use others, close it with the version filter (from the Pro plan).

If nothing helps, turn on maintenance mode (from the Basic plan): only people on a separate maintenance list can join, and everyone else is disconnected.

Banning ranges and networks

When bots come from one address range, you can blacklist it (from the Pro plan), or blacklist a whole network by its AS number (from the Premium plan). Set a duration, for example 1d:

/kordon blacklist add 203.0.113.0/24 1d attack

Be careful with the networks of home and mobile providers. Ordinary players use them too, and banning the whole network closes the server to an entire city.

What not to do

• Do not restart the proxy over and over: the bots are back within a minute, and players notice the downtime.
• Do not switch "If the check is unavailable" to "Let everyone in" in the middle of an attack.
• Do not turn off the "Like Paper" nickname rule, even if it gets in the way of one of your players. Add that player to the whitelist instead.
• Do not ban the networks of whole providers forever.

When the attack is over

Open the report on the "Attacks" page. It shows how long the attack lasted, how many attempts there were and how many were blocked, the peak per minute, the countries, the networks and what the protection did.

Turn off the temporary nickname rules, and reopen countries and versions if you closed them only for the attack. Blacklist entries with a duration need nothing from you: they expire on their own. Checks made during the attack do not count toward your plan's daily limit.

If attacks keep coming and your server does not need to let in players without a paid account, consider switching to online mode. You can also keep "Strict" protection on for good. More in how to protect a server from bot attacks.