Robert Iler

Oh! But you COULD monitor your network while you run the server after installing each mod one at a time. When you see a ping go out from the Host PC after installing a mod, you will have found the/ a culprit!

Perhaps a traffic monitoring application? If the mod is sending the home ping to a filtering or VPN service, though, it won't do us any good.

Agreed. Although, I wonder why it stopped trying to connect if it's getting new pings from the same IP. Perhaps it's programmed to add a bad IP to a "do not connect list" and doesn't check to see if new pings are coming in. More importantly, how can we go about finding the offending mod and holding its creator responsible?

After I made this post, I installed a scanner for minecraft mods and disconnected the LAN cable from the host PC. The scan came up with no malware detections but I elected to the the PC disconnected while I researched the issue further. After 2-4 hours, I reconnected the PC, and ran a couple more scans, and ran the server. I haven't been hit by connection attempts since. Since then I have cancelled and restarted my DNS service, changed modpacks, and changed my forward facing IP address. I have come to the conclusion that it was a bot trying to connect to the server and that disconnecting the PC from the internet caused the bot to remove my IP from its list after a period of nonresponse.

[14:21:56] [Netty Server IO #4/ERROR] [ne.mi.ne.NetworkRegistry/NETREGISTRY]: Channels [structure_gel:main,blue_skies:main,cfm:network,toms_storage:main,aiotbotania:netchannel,alexsmobs:main_channel,cosmeticarmorreworked:main,reliquary:channel,byg:network,lootr:main_network_channel,easymagic:play,moonlight:channel,inventorysorter:net,nether_dragon:nether_dragon,createbigcannons:network,upgradednetherite:main,botania:main,polymorph:main,minecolonies:net-channel,framedblocks:main,supermartijn642configlib:sync_configs,quark:main,tombstone:tombstone_channel,create_sa:create_sa,supplementaries:network,animalistic_a:animalistic_a,create_enchantment_industry:main,artifacts:main,waystones:network,create_things_and_misc:create_things_and_misc,magic_rings:magic_rings,sophisticatedbackpacks:channel,tetra:main,farmingforblockheads:network,unusualend:unusualend,forge:tier_sorting,caelus:main,sophisticatedstorage:channel,crafttweaker:main,create:main,createaddition:main,comforts:main,configured:play,cookingforblockheads:network,productivebees:buzzinga,waterstrainer:main,citadel:main_channel,create_confectionery:create_confectionery,curios:main,extendedflywheels:main,wormhole:main,corail_recycler:recycler_channel,solcarrot:main,structurize:net-channel,trashslot:network,effortlessbuilding:main,nocubescreateexp:nocubescreateexp,sophisticatedcore:channel,patchouli:main,multipiston:net-channel,geckolib3:main,ars_elemental:main,inzhefopcore:inzhefopcore,twilightforest:channel,itshallnottick:main] rejected vanilla connections [14:21:56] [Netty Server IO #4/INFO] [ne.mi.se.ServerLifecycleHooks/SERVERHOOKS]: Disconnecting VANILLA connection attempt: This server has mods that require Forge to be installed on the client. Contact your server admin for more details. [14:22:06] [Netty Server IO #5/ERROR] [ne.mi.ne.NetworkRegistry/NETREGISTRY]: Channels [structure_gel:main,blue_skies:main,cfm:network,toms_storage:main,aiotbotania:netchannel,alexsmobs:main_channel,cosmeticarmorreworked:main,reliquary:channel,byg:network,lootr:main_network_channel,easymagic:play,moonlight:channel,inventorysorter:net,nether_dragon:nether_dragon,createbigcannons:network,upgradednetherite:main,botania:main,polymorph:main,minecolonies:net-channel,framedblocks:main,supermartijn642configlib:sync_configs,quark:main,tombstone:tombstone_channel,create_sa:create_sa,supplementaries:network,animalistic_a:animalistic_a,create_enchantment_industry:main,artifacts:main,waystones:network,create_things_and_misc:create_things_and_misc,magic_rings:magic_rings,sophisticatedbackpacks:channel,tetra:main,farmingforblockheads:network,unusualend:unusualend,forge:tier_sorting,caelus:main,sophisticatedstorage:channel,crafttweaker:main,create:main,createaddition:main,comforts:main,configured:play,cookingforblockheads:network,productivebees:buzzinga,waterstrainer:main,citadel:main_channel,create_confectionery:create_confectionery,curios:main,extendedflywheels:main,wormhole:main,corail_recycler:recycler_channel,solcarrot:main,structurize:net-channel,trashslot:network,effortlessbuilding:main,nocubescreateexp:nocubescreateexp,sophisticatedcore:channel,patchouli:main,multipiston:net-channel,geckolib3:main,ars_elemental:main,inzhefopcore:inzhefopcore,twilightforest:channel,itshallnottick:main] rejected vanilla connections [14:22:06] [Netty Server IO #5/INFO] [ne.mi.se.ServerLifecycleHooks/SERVERHOOKS]: Disconnecting VANILLA connection attempt: This server has mods that require Forge to be installed on the client. Contact your server admin for more details. I'm thinking that this might be a bot constantly attempting to connect to my server. However, my server's ping response is disabled and I've got its true address hidden behind a DNS. An IP phisher shouldn't be able to find my host computer, let alone know that it's hosting a Minecraft server. Is it possible that this is a Forge problem or do I need to start taking steps to change my address and implement greater protection?