What Happens When Your Minecraft Server Is Attacked

Minecraft Java Edition servers are often hit with floods of fake server-list pings or fake login attempts rather than raw bandwidth. VibeSHIELD, the DDoS protection network that comes with every VibeGAMES server, has a filter built for exactly that. This article explains what it does for your Minecraft server, where you can see an attack and what to do.

1What VibeSHIELD Does for Your Minecraft Server

• A Minecraft Java filter protects the game port TCP 25565.
• The filter validates the Minecraft handshake and status pings. Server-list ping floods and fake logins are dropped at the edge before they reach your server.
• Filtering happens at the VibeSHIELD point of presence nearest to the source of the traffic. Only clean traffic continues to your server.
• The protection is included and always on. There is nothing to enable or configure.

2What Players Notice

• In most attacks nothing. Players keep building.
• During very large attacks a few seconds of higher ping or packet loss can occur while the filtering ramps up.
• If the server is unreachable, the attack is rarely the cause. Check the console in the game panel first. A crash, running out of memory during world generation, a plugin error or a wrong port are more likely.

3Where to See the Attack

• Open the website dashboard and click your Minecraft server.
• Go to the DDoS protection tab. This tab is in the website dashboard at vibegames.com, not in the game panel at game.vibegames.com where the console and files live.
• Status reads Active. Attack status reads Not under attack or Under attack.
• The Attack history table lists every attack of the last 30 days with an ID, the peak size in Mbps or Gbps, and the start and stop time.
• Expand a row for a traffic chart over time, the source countries, source networks (ASN), source ports, destination ports, protocol, TTL and packet sizes.

4The Email You Receive

• When an attack targets your server's port, the email address on your account receives a message with the subject DDoS attack detected on your server <ip>.
• It says VibeSHIELD is filtering the traffic and that no action is needed.
• Several servers on a node share the same IP, each with its own port. The attack is attributed to your server by the port that was attacked.

5What to Do

• Let VibeSHIELD handle it. There is no button to press.
• Do not share your server IP with anyone who threatens you, and never pay anyone who claims they can stop an attack.
• Changing the port does not help against attacks and is not needed.
• Moving to another location is not needed. Every location is protected by VibeSHIELD.
• If players report problems during an attack, open a ticket with the attack ID from the history table.

Good to Know

• Fake logins do not fill your console. Because the filter validates the handshake, fake login attempts are dropped at the edge and do not reach the server.
• Players still see your server in their list. Status pings from real clients pass through, so the server shows up with its MOTD and player count as usual.
• Read more. The article on how VibeSHIELD protects your game server explains the network in full.