AntiScan

AntiScan is a protective solution for Minecraft servers that detects and blocks port scanning attempts. The mod integrates with PebbleHost's Hunter system and (optionally) AbuseIPDB — a well-known database of rogue IP addresses. These services allow suspicious IPs to be checked and reports to be filed against scanners trying to access your server.

⚠️ Important: AntiScan is not a 100% guarantee of protection. This tool should be used in combination with online mode and a whitelist.

How It Works

When someone tries to connect to the server, AntiScan obtains data about their IP address and checks it against Hunter and AbuseIPDB databases. Based on this information, a mode is used to determine suspicious activity and an action is taken.

If the connection matches the specified mode (indicating it is suspicious), AntiScan can:

• Let the connection pass without intervention
• Drop the connection entirely
• Freeze the connection (timeout), causing scanners to waste more time waiting

🔍 Interesting fact: freezing connections can annoy attackers, but it also helps slow down large-scale scanning—especially when multiple administrators use the same method.

By linking AntiScan to AbuseIPDB (via an API key), the mod automatically updates the IP blacklist roughly every 5 hours. This ensures the system continually receives new data on malicious addresses (around 10,000 entries at a time) while phasing out old ones.

Protection Stages

• Handshake phase: IP checks during initial connection setup
• Login phase: Standard blocking stage when account credentials are submitted
• Ping checks: Connection latency checks for server lists
• Server queries: Server status queries for Multiplayer menus

Commands & Configuration

Blacklist Management

• antiscan [ip/name] blacklist add <ip/name> — Manually add an IP/name
• antiscan [ip/name] blacklist remove <ip/name> — Remove from blacklist
• antiscan [ip/name] blacklist check <ip/name> — Check if IP/name is blacklisted
• antiscan [ip/name] blacklist list — Display blacklist contents
• antiscan ip blacklist list all — Full list (manual + automatic)
• antiscan ip blacklist update — Update automatic blacklist
• antiscan ip blacklist update force — Force update (ignoring rate limits)

Configuration

• antiscan config abuseIpdbKey <key> — Set AbuseIPDB API key
• antiscan config [handshake/login/ping/query] mode — View/set blocking mode
• antiscan config [handshake/login/ping/query] action — Configure blocking action
• antiscan config [handshake/login/ping/query] report — Enable reporting
• antiscan config log [reports/action] — Configure logging options
• antiscan config blacklistUpdateCooldown <milliseconds> — Set update interval

Other Commands

• antiscan report <ip> — Submit port scanning report to AbuseIPDB
• antiscan stats — Display mod usage statistics

🚨 All commands (except checks) require operator permissions: level 3 or level 4.