Why do I have random users joining my server?

If you’ve checked your Minecraft server console or logs and noticed several connection attempts from unknown IP addresses or usernames (sometimes even your own name or other players’ names), you’re not alone. This happens to nearly every Minecraft server that is reachable from the internet.

These attempts are usually made by automated programs called bots. They are not someone personally targeting you, and in the vast majority of cases they never actually get onto your server.

How did they find my server?

Minecraft servers normally use port 25565. Finding an IPv4 address is extremely easy nowadays, as there aren't that many IP addresses out there, and they are reused all the time, so a simple bot can scan the entire internet looking for that port in roughly 30 minutes. Hundreds of these bots run 24/7/365.

Some bots are relatively harmless:

• Neutral ones that just collect data for websites or tools (for example ServerScannerV2)
• Ones that check whether a server looks insecure and try to warn the owner (like Matscan)
• Others are indeed looking for vulnerable servers to grief or exploit.

Either way, the scanning itself is extremely common and expected.

What do the logs usually look like?

You’ll often see messages similar to these:

• A username “lost connection: Disconnected”
• “Failed to verify username!”
• “tried to join with an invalid session”

These messages mean the connection was rejected. The bot (or person) was not allowed onto the server. This is the system working correctly.

If you see a player “disconnecting” without ever appearing to fully connect, it’s almost always just a bot using an offline-mode style account that got filtered by your security settings. The server is simply telling you the login attempt was rejected. You can safely ignore it.

Can I make the connection attempts stop?

Not really. The bots will keep scanning forever. Most non-malicious ones will check a server once (or once every so often) and then leave it alone. Poorly coded ones and malicious ones may keep trying.

If the log messages bother you, you can block the specific source IP addresses with a firewall or outright ban it. Some of the non-malicious bots also have a website or Discord where you can request that your server be skipped.

Changing your server’s IP address does not solve this. New bots (and the same ones) will simply find the new IP the next time they scan. It wastes time and does not reduce the number of attempts long-term or short-term either.

Is this dangerous?

No, not if your server is secured properly. There are no known exploits that let a scanning bot run code on your host or gain extra privileges just by connecting. The last major issue of that type was the Log4j vulnerability in 2022, which was quickly patched, and it's no longer an issue, as long as you are running the latest version of Minecraft. You can also quickly patch it by enabling the Log4j patch on your ploxhost.yml file if you are running an unpatched version. Still, you should keep your server updated all the time to avoid exploits.

How did someone log in as me / Herobrine?

This only happens if the person or bot actually appears in the game (not if the name just shows up briefly in the logs and disconnects).

It means the server is running in offline mode (online-mode=false in server.properties). Offline mode is only intended for a private home network that is not exposed to the internet. It is commonly used to allow cracked/unlicensed clients, which is not allowed by Mojang's EULA.

By default, Minecraft servers send a partial list of currently online players when someone pings them in the server list. Malicious bots watch a server, collect those names over time, and then try logging in as each one in rapid succession. On an offline-mode server they can succeed, and if one of those names has operator (OP) permissions, they can grief the world.

You can hide the online player list by setting hide-online-players=true in server.properties, but the real fix is to leave offline mode disabled.

How do I secure my server?

Two settings are enough and are quite effective at stopping unauthorized access:

• Online mode enabled (online-mode=true in server.properties, this is the default). This verifies that players have legitimate Minecraft accounts.
• Whitelist enabled with only people you trust added to it.

With both of these active, no one can join unless they are on the whitelist and using a real account. Failed connection attempts in the logs are expected and do not mean your server has been compromised.

Here are some extra things you can do to prevent those connections:

• Change the server port away from the default 25565. Most simple scanners only check the standard port, so this reduces how often you get found. It does not make the server more secure.
• Set up automatic scheduled backups and occasionally test restoring one so you know the backups actually work.
• Use a block-logging plugin (such as Prism) so you can roll back individual unwanted changes without restoring a full backup.

In short: multiple connection attempts are a normal part of running a Minecraft server on the internet. As long as online mode and your whitelist are enabled, you can safely ignore the failed attempts in your logs. Changing the IP address will not stop them.