Unknown Players Joining Your Minecraft Server? Scanner Bots

Published on

Unknown players joining your Minecraft server are usually scanner bots like matscan. What they can do and how a whitelist, online mode and a firewall stop them.

A Minecraft-style server hall with rows of lit racks and AMD Ryzen boxes on a stone table

You gave the address to three friends, yet the console shows names you have never seen. Herobrine tried to join, then a name made of random letters, and players lose connection without ever having joined. Some days it looks as if huge numbers of people are trying to access your server. Most likely nobody leaked your address: bots that knock on every address on the internet found it. Here is who they are, what they can reach, and how to shut them out.

Quick answer: Unknown players joining your Minecraft server are usually scanner bots. They sweep the whole IPv4 range, read your server's status reply and then try to log in. matscan, for example, tries the name Herobrine first to test for offline mode. On a server with online-mode=true and the whitelist on, a bot gets your MOTD, version and player count and is turned away at login. Keep both on (new servers start with the whitelist on since Java 26.3), set hide-online-players=true, and on a VPS or home server block the scanner addresses in the firewall. A ban-ip in the console covers one address at a time and does not stop the scans.

Why Unknown Players Join a New Minecraft Server

Scanning the whole internet for Minecraft servers is cheap. The author of matscan described his setup in a 2022 write-up: a modified masscan sent a packet to every IPv4 address, on every port rather than only 25565, and a second job checked every server already in his database again each hour. He also stored the names of players he saw online, so he could later look up which servers they played on.

What the bots read first is the status reply, the same data your multiplayer list shows. According to the Server List Ping documentation, it holds the version, the player count, a sample of online player names, the MOTD and the server icon. After that, some bots try to log in.

Three things follow from this:

  • A domain name or free subdomain hides nothing. Scanners go through IP addresses.
  • Keeping the address to yourself does not keep you off their lists.
  • Once a scanner knows your server, it keeps checking it.

matscan, Herobrine and the Names in Your Log

matscan explains itself best. Its FAQ calls it "a Minecraft bot that joins potentially vulnerable Minecraft servers and sends a message in chat to inform the admins." It tries the name Herobrine first: if that gets in, the server runs in offline mode, and anyone can join with any name. On an offline-mode server with a whitelist, it may try the name of a player who was online before. It joins only from 151.115.73.107, and the FAQ says its data is not public.

If matscan wrote in your chat, it got in, and so could anyone else. Its FAQ gives the fixes: a whitelist for a private server, online mode or a login plugin such as AuthMe Reloaded for an offline-mode server, and a firewall, BungeeGuard or Velocity for an exposed BungeeCord backend. It also warns that "there are several griefing/harassment groups that use their own server scanners."

Other bots use random names. The honeypot server from the 2022 write-up logged joins from bots called "WwMygQ" and "5PhFta3".

In the console, these visits leave lines like these, all from the server's login code (see Paper's source):

  • UUID of player <name> is <uuid>: the client got past the account check. On an online-mode server that means it logged in with a real account. On an offline-mode Paper server it appears for any name.
  • A line that starts with Disconnecting, then the name and, with log-ips=true (the default), the address, then the reason. For a bot that is not on your list, the reason is You are not white-listed on this server! on vanilla, or You are not whitelisted on this server! on Paper.
  • Username '<name>' tried to join with an invalid session: on an online-mode server, a client claimed a name without a valid login.

What a Scanner Bot Can Do on Your Server

Two settings decide almost everything: online-mode and the whitelist.

Your settingsWhat a scanner bot can do
online-mode=true, whitelist onRead the status reply, try to log in, get kicked. It never reaches your world.
online-mode=true, whitelist offJoin with a real account and play like anyone else, griefing included.
online-mode=false, whitelist offJoin with any name, including an operator's, because in offline mode the name is the identity.
online-mode=false, whitelist onJoin with any name that is on the whitelist. In offline mode the whitelist checks a UUID made from the username (Minecraft Wiki), so a name from your status reply is enough.
Proxy backend with legacy (BungeeCord) forwarding, reachable directlyThe same as offline mode: the backend runs with online-mode=false and believes the player data it is sent.

The offline-mode rows are not theory. In the same write-up, matscan's author mentions a bot that joined every 1.19.2 offline-mode server "and tried joining as past usernames until it found an admin."

How to Stop Scanner Bots, in Order

1. Keep the whitelist on

For a private server, this is the fix that matters. Mojang's 26.3 changelog changed the default: "The white-list property is now true by default." That applies when a server writes a fresh server.properties on 26.3 or later; a server you updated keeps the line it had. Check yours, then add your players in the console:

whitelist on
whitelist add YourFriend
whitelist list

Java operators always get in, whitelisted or not, so keep your operator list short. Our whitelist guide covers the other commands and Bedrock players who join through Floodgate.

2. Keep online-mode=true

online-mode=true

With online mode on, the server only lets in "players verified with the Minecraft account database", so nobody can join as Herobrine, or as you. The Minecraft Wiki is blunt about the alternative: "hackers with fake accounts can connect if this is set to false." If you must run offline mode, a login plugin such as AuthMe Reloaded is the minimum, as matscan's FAQ says.

On a network, players connect to the proxy, and the backends run with online mode off. Only the proxy may reach them. PaperMC's forwarding docs call Velocity's modern forwarding "more secure" and BungeeCord-style legacy forwarding "fundamentally insecure". Our BungeeCord and Velocity forwarding guide walks through the setup.

3. Give the status reply less to work with

hide-online-players=true
enable-query=false
enable-rcon=false

hide-online-players=true stops the server from sending the player list on status requests, so scanners no longer collect your players' names, the names an offline-mode bot would try. enable-query and enable-rcon are off by default; leave them off unless you need them. The wiki warns that anything sent over RCON can be intercepted, "including the rcon password".

For a server only your group uses, enable-status=false goes further. The wiki says "the server appears as offline, but still accepts connections." Status scanners get nothing back. Friends see it as offline in their list but can still join; bots that try to log in anyway still meet the whitelist.

4. Block the scanner addresses in the firewall

ban-ip in the console takes one exact address, not a range (Minecraft Wiki), and the Minecraft server checks it only after the connection has reached it. Scanners come from many addresses. A firewall rule drops the packets before Minecraft sees them, status pings included, and it takes whole ranges. This needs a VPS or your own machine; on a hosted game server you usually have no firewall of your own, so steps 1 to 3 do the work.

With UFW on Ubuntu or Debian, put the block in front of your allow rule for the Minecraft port, because in UFW "the first match wins" (ufw manual):

sudo ufw prepend deny from 203.0.113.0/24 to any port 25565 proto tcp
sudo ufw status numbered

Replace 203.0.113.0/24 with the address or range from your log, and 25565 with your port.

For a longer list, PebbleHost publishes the scanner addresses its honeypots catch in its Hunter repository, updated several times a day. On 3 November 2026 it held 641 IPv4 addresses. An ipset keeps that many entries behind one firewall rule:

sudo apt install ipset
sudo ipset -exist create mc-scanners hash:ip
curl -s https://raw.githubusercontent.com/pebblehost/hunter/master/ips.txt -o mc-scanners.txt
sed 's/^/add mc-scanners /' mc-scanners.txt | sudo ipset -exist restore
sudo iptables -I INPUT -p tcp --dport 25565 -m set --match-set mc-scanners src -j DROP

The set and the rule are gone after a reboot. To refresh, download the list again, run sudo ipset flush mc-scanners and repeat the sed line, or run the repository's block.sh from cron (it uses its own set called blacklist, drops all traffic from those addresses, not only your Minecraft port, and writes to Docker's DOCKER-USER chain unless you change that to INPUT). A list like this only covers scanners someone has already caught. It cuts the noise in your log; it does not replace the whitelist.

5. Plugins that hide the server from pings

Two small projects on Modrinth answer pings only from addresses they trust:

  • Anti MOTD Scanner for Paper, Spigot and Purpur (it needs ProtocolLib) returns no status data to IPs that have never joined. Its page says it cannot stop TCP scans or "scanners that use a MC account".
  • AntiScan for Fabric blocks addresses from the Hunter list and, optionally, AbuseIPDB. Its author calls it "NOT a perfect solution", to be used "in conjunction with online mode and a whitelist", and says it will probably not work behind a proxy like Velocity.

On 3 November 2026, Modrinth listed Anti MOTD Scanner up to 26.1.2 and AntiScan up to 26.2, so check their pages before you install one on a 26.3 server.

6. Keep the address off public lists

Posting your address on server lists and public Discord servers adds the people who browse them to the bots. A port other than 25565 cuts out scanners that only try the default. It does not hide you from scanners that try every port, like the one in the 2022 write-up.

DDoS protection is a separate job. Every Space-Node Minecraft plan includes it at no extra cost, and it deals with floods of traffic, not with one bot that logs in like a player. On our servers you type the whitelist commands in the panel's web console and edit server.properties in the file manager or over SFTP.

What Java 26.4's allowed-connection-ids Will Change

Not in a release yet: Mojang added allowed-connection-ids in 26.4 Snapshot 1 on 22 September 2026, and the latest snapshot when we checked, snapshot 6 of 27 October, did not change it. Snapshot features can change before 26.4 ships.

The idea: players add an id to the address they type, written as id@host, and the server only answers connections that carry an id from its list. In Mojang's words, anyone without the correct id "will not see the status and will not be able to join the server". A scanner sweeping IP addresses does not know your id, so it gets nothing back.

The id travels in an unencrypted packet, so "properties should not be used for any security-sensitive purpose", and anyone who sees the address your players type has the id. Treat it as a way to stay hidden; the whitelist and online mode still decide who plays.

FAQ

Why are random players joining my Minecraft server? Scanner bots found it by trying every IPv4 address, and now they try to log in. With online mode and the whitelist on, they are kicked at login. If one got into your world, turn the whitelist on and check that online-mode=true.

What is matscan, and should I block it? A bot that joins servers that look vulnerable and posts a chat message to warn the admins. It joins only from 151.115.73.107. Blocking that address hides the warning, not the hole, so fix whatever let it in.

Why did Herobrine try to join my server? Most likely matscan, which tries Herobrine first: if that name gets in, the server is in offline mode and anyone can join with any name. On an online-mode server the attempt fails.

Does a whitelist stop scanner bots? On an online-mode server, yes: a bot cannot join unless its account is on the list. It can still read your status reply, so add hide-online-players=true. On an offline-mode server, no: a bot that uses a whitelisted name gets in.

Is banning the IP in the console enough? No. ban-ip covers one exact address, and scanners come from many. On a VPS or home server, block whole ranges in the firewall, and keep the whitelist on either way.

Why do players lose connection without ever joining? Usually those are bots that started a login and were turned away or stopped partway. Nobody saw your world. For a name you do not know, look for a Disconnecting line with the whitelist message.

Sources

All opened on 3 November 2026: