1. Purpose
MCSec helps Minecraft servers protect themselves and their players from network addresses that attack them: bot floods, crash exploits, password guessing and similar abuse. It is a shared early warning, built from what real servers block. It is not a judgement about a person.
2. Where listings come from
- Servers listed on CraftRank that send reports through the MCSec API with their server API key. Only servers that are live on the list can report.
- Our own security systems (RexOS Shield and RexOS Edge), for attacks they stop on CraftRank. These count as one reporter.
Every report names one of 16 categories: Bot join flood, Ping & status flood, Query flood, Network flood (DDoS), Crash exploit, Packet spam, Login brute force, RCON brute force, Server scanner, Port scan, Forwarding bypass, Remote code attempt, Chat spam bots, Open proxy or VPN abuse, Website attack, Hosting panel attack.
3. How a listing is scored
Each address gets a confidence score from 0 to 100, worked out automatically from the reports of the last 30 days. Reports count more when they are recent (a week-old report counts half), when the same reporter saw the address several times, and when the reporter's past reports are confirmed by other, independent reporters. Crash exploits and remote code attempts weigh more than scans.
- Reports are counted per owner: several servers run by the same person count as one reporter.
- One reporter alone can never take an address above 55.
- Home and mobile connections are capped at 60, because their addresses are shared and change hands.
- An address with a score of 40 or more is listed. Servers using the default setting refuse addresses at 75 or more; each server chooses its own threshold.
4. What is published
Listings are shown with a random reference number (MCT-XXXXXX), the category, the confidence score, the country, the network (AS number and name) and when the address was reported. The address itself is never published. Reporting servers are shown by a number, not by name. Anyone can check whether one address is listed; checks are limited to stop anyone from mapping the list address by address.
5. Duties of reporting servers
By sending reports, a server owner agrees to:
- report only addresses their own server blocked, in the category that matches what happened;
- write short, honest evidence (what was seen and how much), without payloads, personal data, links or addresses;
- never report addresses to harm a competitor, a player or anyone else, and never send reports that were not caused by real traffic;
- keep the server API key secret and tell us if it may have leaked.
We check reports against each other. A reporter whose reports are not confirmed by others loses weight; reporters that break these rules are blocked from reporting and from the list, and their reports stop counting.
6. Using the list
Addresses received through the API may only be used to protect servers, websites and services you operate, for example to refuse or rate-limit connections. You may not publish, resell or share the addresses, combine them with other data to identify, contact or target a person, or use the list for any decision that is not about security, such as hiring or credit. Pull the list no more than once a minute.
7. Accuracy and no guarantee
The list is a signal based on reports, not proof. Addresses can be shared, reassigned or misused by others. We do not guarantee that a listed address is malicious or that an unlisted one is safe, and we are not responsible for decisions a server makes using the list. To the extent the law allows, the list is provided “as is”, as described in the liability section of our Terms of Service.
8. How a listing ends
A listing ends on its own when the reports stop: after 14 days without reports, or 3 days for home and mobile connections. Reports are kept for 90 days, and an address that is no longer listed is deleted 90 days after its last report.
9. Appeals and removal
If your connection is listed, you can appeal from that connection. Appeals must come from the listed connection so that nobody can remove a listing for an address that is not theirs.
- Home and mobile connections leave the list while the appeal is looked at (once every 30 days).
- We review the reports and answer by email, usually within one working day.
- An accepted appeal removes the listing for 30 days. It returns only if two or more independent reporters report the address again after the appeal.
If you cannot use the appeal page, or you represent a network or hosting provider, contact us at abuse@craftrank.org with the reference number.
10. Legal basis
We process listed addresses on the basis of legitimate interests: protecting Minecraft servers, their players and this site from attacks, and helping others do the same. We limit what is published, keep data only as long as needed, and give every listed connection a way to object through the appeal process. Details are in our Privacy Policy.
11. Changes to this policy
We may update this policy, for example when we change how listings are scored. The date at the top of this page shows the latest version.
12. Contact
Questions about MCSec or a listing: abuse@craftrank.org, or through our support page. Please include the reference number (MCT-XXXXXX). This policy is written in English; translations are provided for convenience and the English version applies if they differ.
