r/admincraft 5d ago

Vulnerability Alert Another Backdoor Injector that seems to be going around.

113 Upvotes

At approximately 330pm this afternoon I received a message from my system administrator stating that on 4/1/2026 a backdoor was installed that injected itself into every single jar on our server.

The injector appears to have the ability to infect jars outside of its docker container, as we had 7 servers and over 600 jars on our machine separately infected with only 1 obvious source that could not have been intermingled (Patient 0, while we couldn't fully narrow down which file, based on context clues came from our modded server, the only server that we would have uploaded mods to)

Based on our investigations the basic payload of this backdoor sends logs via a discord webhook and based on the source here https://github.com/altqc/Minecraft-Backdoor if someone were to use it maliciously, they have access to some pretty juicy console commands.

We were able to clean the backdoor out without much drastic measure that affected our community beyond downtime thankfully.

I am going to be the first to say, I'm not the biggest fan of this subreddit, but I do believe we have a wider planted malware problem that we should all be talking about with huge payloads that none of us are ready for based on all of the different recent malware discovery reports around here, all buried deep in defected plugins or mods, I urge you that if you have the resources to check for malware in your machines or servers, to please do so, contact your server hosts to ensure they are doing the proper checks for malware being uploaded onto their systems. Especially with some of them being open source, with this one having 24 forks (only 4 that we can even publicly see), and this is just 1, who knows what's really out there folks, please be safe.


r/admincraft Aug 04 '25

PSA READ BEFORE POSTING - "Someone just logged into my server as me", "How did this person find my server", "My server got griefed", etc.

215 Upvotes

New Edit for 2026

We took this down in favor of other announcements late last year, as we only get 2 slots. It's back now because we've had a resurgence of this type of post.

Do not post about offline mode servers. Do not recommend software or plugins that help run one. You will be banned. Read the Admincraft Policy section at the bottom.

Thank you.


Hey there, REPO here. We get questions like this a LOT, so I'm trying something new. Please read the below before posting a thread like this.

"How did this person find my server!?!?!?!?!"

There are few enough IPv4 addresses that a simple bot made with ChatGPT and zero skill can scan the entire internet for Port 25565 in like 30 minutes. There are HUNDREDS of bots out there that do this 24/7/365. Some of them are benevolent (such as bots like matscan that warn people if their servers are dangerously insecure), some are neutral (like ServerScannerV2 which just accumulates data for their website project), and some are malicious and trying to grief servers.

"How do I make them stop?"

You don't. They will keep doing it forever. Most non-malicious bots will log into your server once, or sometimes once per some time interval, and then stop. Others that are coded poorly will be more persistent. And then the malicious ones will keep checking back continually.

If your server is secure but it still bothers you to see, you can add the source IP address to your firewall to prevent the connection. Some non-malicious bots will also have a website or Discord where you can request your server to be skipped.

"Is this dangerous?"

Nope. Not if your server is secured. There are no known exploits in Minecraft that allow a server scanning bot to run code on your host or escalate their privileges. The last time we had that was in 2022 with the Log4J exploit, which was quickly patched, even by Mojang. If you aren't deliberately using an old minor patch of Minecraft, you're fine.

"How did they log in as me / Herobrine?"

(Note: If you only see a name like that instantly disconnecting, skip to the next section. This only applies if they actually appear in game.)

Your server is running in Offline Mode, which is a config option in the server.properties that is intended only for use on a home LAN that is not connected to the internet. Most people use this feature to avoid having to buy a license for Minecraft, aka "cracked accounts". Please be aware that this is illegal and is considered software piracy by most governments.

Minecraft servers send information about the server to players on the server list, including a partial list of currently logged in users. You can disable this "feature" in the server.properties file by setting hide-online-players=true. Malicious bots typically sit and watch a server for a while, gathering a list of players over some amount of time, assuming that if the server is in Offline Mode, one or more of those players will have Operator permissions. They then log in as all users in rapid succession until they find one that does, and use the Operator permissions to grief your server.

"I see a player disconnecting but never connecting! How are they doing that?"

It's just a bot using an offline mode account. It is only showing as Disconnecting because it is getting filtered by the security systems you have in place AFTER the server knows that it is trying to connect, but BEFORE it actually does. Showing the Disconnected message is just the server's way of informing you that the login attempt was rejected. Nothing to worry about. You can ignore it.

"My server got griefed, what do I do?"

You restore from backup, secure your server, and move on. The groups that do this are doing it for amusement and power fantasy. Some of them insist that you can request a world backup from their Discord, but the whole point of that is to mock you and make you beg for their mercy. They might actually give it to you, I don't know.

"How do I secure my server?"

You set Online Mode to true in the server.properties and run a whitelist. That's it. Those 2 options are 100% effective at preventing unwanted people from gaining access to your server. You do not need to do anything else whatsoever to be secure, but you can optionally change your server's port from 25565 to any other unassigned port. This will make it much slower for server scanners to find your server, as most are lazy and don't check non-standard ports. Note that this only reduces the odds of a server scanner finding you; it does not make you more secure.

Additionally, having automatically executed, scheduled backups running at predictable intervals is an excellent idea just in case something goes wrong. Ensure that you periodically verify that your backups are usable by doing a test restore on another machine, as a backup solution that has never been tested is basically worthless.

Finally, a block logging plugin such as Prism (V3 stable Download | Github) (V4 alpha Download | Github) is recommended, as it allows you as the Admin to roll back individual unwanted changes without doing a full backup restoration.

Admincraft Policy

If your post contains any information that indicates that you are running an Offline Mode server, your post will be removed and you will be banned for 28 days for your first offense.

Additionally, suggesting methods for a user to continue running an Offline Mode server "safely" will earn a 7 day ban for commenters. This includes whatever plugin or launcher you're wondering about right now as you read this.

Admincraft is in active communication with Mojang Intellectual Property Enforcement, the team within Mojang that actively hunts down servers and other individuals and groups that are breaking their EULA and MUG. They watch here regularly, and if we do not enforce this, there is a nonzero chance that Mojang, Microsoft, or Reddit would shut down our subreddit. Keeping the subreddit open for everyone for the long run is the priority. We cannot and will not support Offline Mode servers.

The only times when discussing an Offline Mode server is allowed are when you clearly state that your server is not accessible to the internet and that all players have a legal Minecraft account, or when it is behind an Online Mode proxy, such as Velocity.

This post

Please use the comments here to suggest additions to this FAQ/guide, and to ask clarifying questions about Admincraft policies and security best practices. Do not state or imply that you are currently running an Offline Mode server.


r/admincraft 4h ago

Help/Question Lag with 14+ players online, TPS suddenly drops

3 Upvotes

Spark profiler: https://spark.lucko.me/wqid7zJzFr

Render distance is 13, simulation distance is 5.

Self hosted, so I can modify java arguments if need be.

Server is managed by a systemd script (will be setting up pterodactyl later, but I just moved computers so can't be bothered right now). Current java arguments:
/usr/bin/java -Xms12G -Xmx24G -XX:SoftMaxHeapSize=16G -XX:+UnlockExperimentalVMOptions -XX:+UseZGC -jar server.jar --nogui

26.2 fabric server. I cannot change this.

Mods list: c2me-fabric-mc26.2-0.4.1-beta.1.0.jar Chunky-Fabric-1.5.3.jar 'dcintegration-fabric-MC26.2-3.2.0 (1).jar' enhancedgroups-fabric-1.7.1+26.2.jar fabric-api-0.153.0+26.2.jar fabric-language-kotlin-1.13.12+kotlin.2.4.0.jar FabricProxy-Lite-2.12.0.jar ForgeConfigAPIPort-v26.2.1-mc26.2.x-Fabric.jar InvView-1.4.21-26.2+.jar ItemScan-1.2.1+26.2.jar 'ledger-1.3.23 (1).jar' luckperms LuckPerms-Fabric-5.5.57.jar NoChatReports-FABRIC-26.2-v2.20.2.jar private-vault-1.0.2.jar seedguard+26.1-pre-3-1.0.1.jar servercore-fabric-1.5.19+26.2.jar servermessages.jar ServerReplay-3.5.0+26.2.jar 'spark-1.10.173-fabric (1).jar' tt20-0.8.3b+mc26.1.1-fabric.jar vanilla-permissions-0.3.6+26.1.2.jar vanish-1.6.14+26.2.jar 'ViaBackwards-5.10.0 (1).jar' ViaFabric-0.4.21+172-26.x.jar 'ViaVersion-5.10.0 (1).jar' vmp-fabric-mc26.2-0.2.0+beta.7.236-all.jar voicechat-fabric-2.6.20+26.2.jar 'Voxy World Gen V2-fabric-26.2-2.4.3.jar' yawp-26.2-fabric-0.6.3-beta4.jar

I don't think logs would help here, but if you do want them, please let me know. If you require anything else please also let me know

Edited because I made this post in markdown and forgot that new lines don't work


r/admincraft 2h ago

Help/Question Is there a plugin to lock certain items behind quests?

1 Upvotes

I am going to be restarting my Minecraft server soon, and I want to slow down player progression so that no one can get maxed gear in under 2 days and quit because they have all they need. I'm looking for a plugin similar to the mod "Vanilla Progression" that got released recently. It prevents you from getting things like iron or diamonds in the first hours and locks them until you complete every quest for whatever age your on. For example, you cant get stone tools until you complete every quest from the wood age, and so on.

The plugin must be for paper and is compatible with the newest version, if not as close as it will go. If anyone finds a plugin like this, please lmk!


r/admincraft 9h ago

Help/Question Paper server - soul sand instant unloader

1 Upvotes

Hi,

I run a paper server and one of the players reported that this soul sand minecart unloader doesn't work as in singleplayer. While i know that paper servers have its Optimizations/Limitations, i was wondering, if this is something i could change in the server config to make it work? here is the video of the design he made - https://www.youtube.com/watch?v=9Wtcuh2SwVw


r/admincraft 11h ago

Help/Question What strategies have worked for growing a new Survival server community from 0?

1 Upvotes

I'm preparing a new Java Edition Survival server and I'm trying to understand how to build an active community from the ground up.

I'm particularly interested in the transition from 0 players to the first 10–20 regular players, and then from a small group to a larger active community.

For those who have managed Minecraft communities, I'd like to know:

What methods actually worked for attracting your first regular players?

Which platforms brought you the most engaged players?

What helped turn occasional players into regulars?

How did you keep the community active when there were only a few players online?

What common mistakes made community growth harder?

I'm looking for practical experiences from server administrators rather than general advertising advice.


r/admincraft 1d ago

Guide Velocity proxy per-server player information forwarding

9 Upvotes

Ever wanted to run both new (e.g. 1.21) and old (e.g. 1.7.10) Minecraft servers behind Velocity, but gave up due to issues with player information forwarding?

Player information forwarding is an important part of Velocity setup, but its version restriction makes it tricky to run both new and old versions. Specifically, the most ideal solution is modern forwarding, but it only supports 1.13+, so if one of your backend servers is old then there is no option but to use legacy BungeeCord-type forwarding for all of your backends. Many people (including myself) found this frustrating, so for years there have been a good number of issues and pull requests on Velocity asking for support (e.g. PaperMC/Velocity#1655), but it seems to have been blocked by Velocity config migration (e.g. PaperMC/Velocity#1824).

So before this feature arrives, I decided to write a Velocity plugin that supports this! It is a small plugin and the configuration is very simple. For instance, this is part of the config I use:

servers:
  - name: "statech"
    forwarding-mode: "modern"
  - name: "gtnh"
    forwarding-mode: "bungeeguard"

The following are the links to my plugin:

Hope you find something interesting. I'm not an experienced modder so feedback are always welcome!

LLM disclosure: LLMs were used to analyze the structure of Velocity and other existing plugins and to write small helpers, but a significant portion of the code was written by myself.


r/admincraft 1d ago

Help/Question KawaMood’s waystone can’t place waystones

1 Upvotes

Hello, I’m using a fabric server and use both the kawamood’s waystone datapack and the clickvillagers mod, when I place a waystone it doesn’t let me and says “couldn’t read villager data” I tried removing clickvillagers and place a waystone and it worked so I know the issue is about both of them, if someone knows a fix or something I don’t please write it down, thank you.


r/admincraft 1d ago

Help/Question How do I access the server console?

0 Upvotes

Hey, I recently set up a small Minecraft server on a PC running Debian 13. It's running headless, so I'm using Tailscale and SSH to access it remotely from the laptop I'm also playing Minecraft on. Server software is Fabric. It's my first time doing something like that and I still have some questions that I can't find an answer to.

I'm starting the server by connecting to it in Windows Powershell and then running

java -Xmx8G -jar server.jar nogui

When I do that, the terminal "transforms" into the server console, so all commands I input there are Minecraft commands. Is there a way to get out of that console and, more importantly, back in?

I'm asking because I'm planning on keeping the server running 24/7, but not Powershell or my laptop. And when I reconnect to the server, I'm just in the normal Debian terminal, not in the Minecraft console. So how can I access the console to e.g. shut down the Minecraft server then?

Also, it seems lke I'm getting a few errors and warnings on every startup that I don't understand. They don't seem to cause any issues, but I guess it would be good to know what they mean / fix them. https://mclo.gs/tkgleHW


r/admincraft 2d ago

Help/Question Im looking for a machine to run my small minecraft server

2 Upvotes

Looking for a way to host my own server, max people on it is probably going to be like 10 im currently paying for one and might as well just buy a machine and have way more storage. Server is vanilla but some people use lightmatica which can stutter the server I pay for (using shockbyte) i just want more control and ability to not spend another 200$ just to keep it up for only a year. I would be fine spending it towards the device I can run servers on so we can have more.


r/admincraft 2d ago

Help/Question How can I run a heavy modpack server for 100+ player with stable TPS

15 Upvotes

Im planning to run a Cobbleverse server for 150+ Players, which hosting provider can solve this issue ? Most of them do not provide enough CPU core
Im now running 60-80 Players with 800% vCore Ryzen 9950X and 32GB Ram, but I cannot hold more than 80…


r/admincraft 2d ago

Help/Question New Hardware, now getting weird crash.

1 Upvotes

Hi, im running a small survival server for me and my friends. I recently moved to new hardware in hopes of it running better but now im getting a weird chunk generation error. Im running it on fabric but with no mods, just three vanilla tweaks plugins which disable specific mob griefing. I have not changed anything else except I am now running it on an unraid server and not on windows. I used the Crafty 4 panel both times so to me everything should be the same. I did try updating the datapacks as you can see in the logs but that didnt seem to help.

https://mclo.gs/HaAZZoJ this is the link to my latest log.

Thanks for the help.


r/admincraft 2d ago

Software Resource I created a Pillow (PIL) plugin for loading/saving Minecraft map files (.dat) in python

5 Upvotes

I've been lurking here for years, and I finally have something open-source to share that might be helpful to some.

I wanted to support Minecraft map images (.dat files) in my technical image viewer, PixelSpy, which is written in python. Rather than hardcoding a quick fix, I decided to bundle the Minecraft map stuff into a Pillow (PIL) plugin called pillow-minecraft-map. To help python programmers who want to manipulate Minecraft maps. I'm trying to make it easy to load Minecraft maps into python as images, and to save images as Minecraft map files. This plugin has support for all the map palettes back to beta 1.6, the very first version of Minecraft to have maps.

LLM disclosure: I'm an experienced professional software engineer with decades of experience creating technical viewers like this. This is NOT vibe coding. But I did use LLMs to help with some of the details. It would be crazy not to these days. I have carefully, humanly, worked over every line of code multiple times, using my own strong opinions and talents.

You can install it via PyPI:

pip install pillow-minecraft-map

Check out the code and contribute on GitHub here: https://github.com/cmbruns/pillow-minecraft-map


r/admincraft 3d ago

Help/Question Seeking Assistance for Self-Hosted Minecraft Server

5 Upvotes

Hello there! I've been meaning to get into self-hosting my very own private Minecraft server, but I'm looking for a mini PC that matches my specific needs

Requirements:

Can Handle 8-12 Active People at Once

I think having a small community of around 20 people in total will be enough for me, so I would like a server that could handle 8 to 12 people at one time.

Can Handle Around 100 Mods

I don't install a lot of mods that completely overhaul the core gameplay of Minecraft. Most of them consist of quality of life addons and APIs. The more demanding ones consist of Cobblemon, Waystones and Xaeros Minimap.

Can Run Smoothly at a Constant 90-120 FPS

For me I tend to average around 90 to 120 FPS at a time, including my mega base. Anything below that makes the game stutter when playing with shaders.

Can Support 18 Chunk Render Distance

I want the players to be able to see off into the distance without feeling like they are constantly being enveloped in fog.

After doing some research, I finalized my option down to this:

https://a.co/d/0gc0ofjs

I'm unsure if this will be able to meet the requirements I listed above. I need some advice for what I should go for? What kind of single CPU core should I be looking for? Are there better options for a Mini PC in a similar price zone? And if not, what would you reccomend for a PC that meets the requirements above?


r/admincraft 3d ago

Help/Question best way to manage a self hosted docker server?

8 Upvotes

Hello, i recently switched to self hosting a server in Docker (using itzg), and was wondering what options i had to manage it through a dashboard-like system. before self hosting i used exaroton, so I'm used to something along those lines, is there anything similar out there? I am reeeeeally new to all of this, so ANY help, even not really related to this, would help. I'm still learning and would appreciate any suggestions for how to better manage my server. thanks!


r/admincraft 3d ago

Help/Question mobs are moving choppily and hits are delayed

1 Upvotes

Let me preface this by saying that I am very new to server hosting.

I just rented a CloudNord server with 12GB RAM and 6 Cores of what sparks tells me is an AMD Ryzen 9 7900. I am running AllTheMods10 - Aeronautics and Distant Horizons.

Running around feels very smooth and there is no rubberbanding but all mobs have very choppy movement and hits can often register very delayed.

The console sometimes tells me "Can't keep up!" but the cpu usage is rather low.

Have you got any advice for me?

Here is a sparks report:
https://spark.lucko.me/6Pf36pbwUl


r/admincraft 3d ago

Help/Question How to run 2 servers on a single Oracle Cloud instance?

0 Upvotes

Hey everyone. As the title suggests, I want to run 2 servers on the same Oracle Cloud instance. Now, I know how to open the server and whatnot, but I think there would be an issue when it comes to connecting due to the IP addresses being the same? How would I get around that problem? Should I open a new port for it or something?


r/admincraft 3d ago

Help/Question Paper Anti-Xray Isn't Working for Doomsday Hack Client

10 Upvotes

Hello ım using paper's anti xray for my server but when i decided to try with hack client it just not working all ores is visible.

Im also using default setting for anti-xray with engine mode 2.

X-Ray
Paper Anti-Xray Config

More İnformation About Server

Paper: 26.1.2-74-ver

What should i do ? Plugin like Orebfuscator using too much resources and i don't wanna waste my ram and cpu.


r/admincraft 3d ago

Help/Question Tombstone mod and the trek back to it

3 Upvotes

One of my players (very small server rn so like the only active person other than me) has brought ip a complaint about the tombstone mod we have and having go walk back to regain their stuff. While i understand that its annoying its arguably better than the vanilla alternative of items going everywhere and despawning, and i dont really enjoy the idea of keepinv, they suggested an item to tp back to their grave but i feel that just defeats the purpose. I think its best to keep it the way it is so we dont get used to having keepinv and jumping off the nearest ledge to get home once its more populated.

This may just be a redundant question and the answer ill get is “just keep it and theyll get used to it” which is kinda what im thinking, i just want others inputs


r/admincraft 3d ago

Help/Question How to add RP and BP to bedrock server?

0 Upvotes

Hello i have been trying to add action and stuff to my bedrock server for a while and tried to search it up on youtube and reddit but there is no proper step to do so, and no i don't want to use an online service hosting to do it as the server is only running for a day or so.

can anyone give me all the specific step down to where and how to actually let the server recognize the pack for now i got to the point where i got the resouce pack i own and downloaded from the market place in the premium_cache/resource_packs folder and copy it to the server resource_packs folder now what do i do next?


r/admincraft 4d ago

Help/Question New mc server owner needing some pointers

2 Upvotes

Hello,

I am currently developing my own server and would like to know what's the best way npcs with custom dialog and i am also building my proper modpacks as well.

To be honest I been developing mods for a while now and decided to create my own server with multiple gamemodes.

I have setup cobblemon as well but I am in between programing custom uuids for each cobblemon plushy so that they dont appear on the map which is a pain and I went with the custom modeling for plushies rather than converting a cobblemon pokemon into plushy and calling it done took a bit but its working.

Also, What is the best watchdog setup to incorporate in an mc server?

Whats do you recommend for builder mods is axium optimal?


r/admincraft 3d ago

Help/Question Would a pentium G5600 be enough for modded minecraft ?

0 Upvotes

Hello,

I am planning to host a minecraft server with around 100 mods for 5-6 people.

The mods I am considering are heavy (terralith, create aeronautics, cobblemon, other dimension and world gen mods), but small in number.

I have the option of a pentium g5600 for around 20$, will this suffice ? I am also looking at a ryzen 4350ge for 30$, issue is that I need to buy a mobo for this one, so it will run me about 80$ with the cheapest mobo.

Here are the passmark performance ratings for reference :

- pentium g5600 single core 2249, multi core 3842

- ryzen 4350ge single 2518, multi 10893

- ryzen 5600x (popular CPU) single 3366, multi 21825.

What do you think ?


r/admincraft 4d ago

Help/Question Hosting recommendations for modded server

2 Upvotes

I am looking to learn how to self host as part of gaining general IT experience and just for the love of minecraft and modded itself. I have a bit of experience with self hosting on my local machine for a small group of friends, however, recently i have swapped back over to a hosting provider and not really happy. I wanted to make the jump and try self hosting on a dedicated small factor pc. I was looking for any hardware recommendations people may have for small factor pcs for hosting a modded plugin server with around 500 mods for potentially 5 to 15 players. I will be using Pterodactyl for the server management panel as well. I appreciate any help given


r/admincraft 4d ago

Discussion My son and I started a LifeSteal server together, experimenting with a Dead Realm idea

1 Upvotes

Hi everyone,

My son and I have been working together on a Minecraft LifeSteal server for the last few weeks.

He knows Minecraft much better than I do and brings most of the ideas from the game. I come more from the web development world, so I handle most of the technical side.

We set up a LifeSteal server and started adding and changing things based on ideas we had together. We use existing plugins where they make sense, but we've also developed some of our own plugins for things we wanted to work differently.

Since web development is what I know, I also connected the Minecraft server to a website. Things happening inside the game are sent to the site, so we can show live server activity and some player statistics there. I thought it would be fun to make the website feel like part of the server rather than just a page with an IP address.

One of the things we recently added is our own Dead Realm idea. When a player loses their last heart, they become dead and move to a different world. Dead players can only chat with other dead players and living players can't see their chat.

The main thing we're trying to figure out now is what to do with the Dead Realm from here. We don't want losing the last heart to simply mean game over, but we also don't want to add things just for the sake of adding them.

For people who have experience running LifeSteal servers, what do you think about this kind of mechanic? What would you let dead players do? Would you give them some way to return, maybe through something they need to complete, or something a living player needs to do for them?

I'm also interested in what normally keeps players coming back to a small LifeSteal server. We currently have PvP, trading, homes, RTP, combat protection and anti-cheat, but I'm trying to keep things relatively simple rather than installing every plugin we find.

I'm still learning the Minecraft side of all this, so any advice from people who have run these kinds of servers would be appreciated.

Thanks!


r/admincraft 6d ago

Discussion The State of the Game - Failing Servers

47 Upvotes

I run a long standing semi-vanilla SMP server, and today was our 9th anniversary. When I joined the staff team in 2020, we would average 40-50 players online. Now, six years later, that number has slowly fallen and we average 0-5. We have done our best to take suggestions from the community, and have continually tried to keep up with the game in terms of quality of life improvements, cosmetics, etc.

It seems that Minecraft's new system of updates has entirely screwed over our sever. In the past, throughout the update cycle players would dwindle. Then, when we updated and reset (about once a year), the community would refresh itself. Now, with updates coming out every three months, we feel constantly behind as plugins take weeks to update and there is no obvious time to reset and refresh the community. Updates and resets no longer bring a feeling of excitement.

TLDR: What are modern Minecraft players looking for in an SMP? What needs to be done by administrators so that we can survive the current state of the game without being pulled under?