From f971105c9c446b97431c0cedfc47bc270b805429 Mon Sep 17 00:00:00 2001 From: Royce Williams Date: Thu, 6 Oct 2022 22:22:17 -0800 Subject: [PATCH] Background tidbits --- README.md | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c10ac50..c220903 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,37 @@ Don't prune identified strings that have been removed from identified.txt -- I'm ## Background information on the blocklist -This section intentionally left blank. +For a server to reach some level of popularity and discoverability, it must either have +a persistent hostname, or have its IP known. + +Large lists of Minecraft servers are generally unpublished, to reduce risk +of random 'griefing' (DoSing or otherwise harassing servers). Perhaps these +servers can still be used in other ways, even when blocked by Mojang. +Mojang apparently started using this blocklist method on May 1, 2016. + +There appear to be three classes of entries: + +### Hostnames + +This including wildcards, typos, '?' appended, mixed case, and other anomalies. +Minecraft servers don't need to know their own hostname to +function, so many simple setups have no detectable distinct hostname at the +Minecraft level - so scanning the Internet for servers is not very useful. +But looking for lists of servers that allow cheating, or known to have weak +anti-cheating measures, is effective. + +### IPs + +This includes RFC1918 IPs. May also include naive classful wildcards, (192.168, etc.). +This set of hashcat masks for all valid IP addresses can be run after every new hash is added: + +https://github.com/johnjohnsp1/hexhosts/blob/master/ipv4.hcmask + +### Test entries + +These are not valid DNS FQDNs, or even hostnames (some have spaces, underscores, etc) +These often have "dns" and/or "test" in them, with various combinations of +separators (including space), case, and appended digits. ## Thanks