What AntiBot is

AntiBot is a plugin specialized in protecting a Minecraft server from bot attacks. Bot attacks are one of the most common forms of server griefing: the attacker launches hundreds or thousands of fake connections (bots) that join the server at the same time and overload it.

The plugin analyzes connection patterns and tells real players from bots based on connection speed, behavior after joining, client headers and IP history. It works both on a single server (Spigot/Paper) and on a proxy (BungeeCord/Velocity).

AntiBot is available on SpigotMC. Several other plugins of this type exist. The most commonly used are BotSentry and EpicGuard, which fill a similar role.

Types of bot attacks

Minecraft servers are exposed to several types of bot attacks:

Join Flood - hundreds of bots connect at once, filling the server's slots and causing lag
Chat Spam - bots join and spam chat with ads, links or offensive content
Login Brute Force - on offline-mode servers, bots try to log in to real players' accounts
Register Spam - bots register thousands of accounts through AuthMe, filling the database
Crash Bot - bots send malicious packets that can crash the server
Proxy Bot - bots connect through a VPN/proxy to get around IP bans

Protection methods

AntiBot uses several layers of protection:

Rate Limiting - a limit on connections per second. If 20+ connections arrive within a second, the plugin activates protection mode
Movement verification - after joining, a player must move within X seconds. Bots usually stand still
IP blacklist - automatic banning of the IPs that bots come from
GeoIP - blocking connections from countries your players shouldn't be coming from (e.g. on a Polish server, block Asia)
VPN/Proxy Detection - detecting and blocking connections through a VPN or proxy
Whitelist mode - during an attack only verified players can join

Commands

Command	What it does
`/antibot status`	Shows the protection status (normal / attack)
`/antibot whitelist add Player`	Adds a player to the whitelist (skips the filters)
`/antibot blacklist add IP`	Adds an IP to the blacklist
`/antibot toggleprotection`	Manually turns protection mode on/off
`/antibot stats`	Statistics: blocked bots, connections per second
`/antibot reload`	Reloads the configuration

Configuration

The plugins/AntiBot/config.yml file:

# Rate limiting
connections:
  max_per_second: 5              # max connections per second (normal mode)
  attack_threshold: 15           # threshold that activates attack mode
  attack_mode_duration: 60       # seconds in attack mode

# Verification
verification:
  enabled: true
  timeout: 10                    # seconds to verify after joining
  type: movement                 # movement or captcha

# VPN/Proxy
vpn_detection:
  enabled: true
  block_vpn: true
  api_key: ""                    # API key of the VPN detection service

# GeoIP
geoip:
  enabled: false
  allowed_countries:
    - PL
    - DE
    - GB

On a proxy (BungeeCord/Velocity), install AntiBot on the proxy, not on the individual servers. The proxy filters connections before they reach the server.

Tips for admins

Proxy first - if you run BungeeCord or Velocity, install AntiBot on the proxy. It's the most effective place to filter
Don't block VPNs by default - many real players use a VPN. Turn on VPN blocking only during active attacks
GeoIP for regional servers - if your server is aimed at players from one country, limit connections to that country and a few of its neighbors (e.g. PL and DE for a Polish server). Most bot attacks come from Asia and South America
AuthMe + AntiBot - on offline-mode servers, AntiBot + AuthMe is the absolute minimum for security
Cloudflare TCP - for advanced DDoS protection consider Cloudflare Spectrum or TCPShield, which filter traffic at the network level

Related plugins: AuthMe (player login), ExploitFixer (protection against exploits), IPTables (IP management).