Shodan crawls a lot of different ports and it's most known for the Internet of Things devices it uncovers, but did you know that Shodan also tracks Minecraft servers? Lets start out by seeing which countries most of the Minecraft servers are hosted in and which provider is most popular.

There are around 115,000 Minecraft Servers on the Internet at the moment running on the default port of 25565. Interestingly, the majority of servers are actually located in Germany. And so it's not a great surprise that the most popular hosting provider for Minecraft is Link11. Link11 though mostly just offers colocation/ datacenter services, but looking at the Minecraft banners from Link11's IP space let me know that the company behind these servers is Nitrado. I hadn't heard of them before, but based on these numbers they're the most popular way to host Minecraft!

Want to find a nearby server with a good ping that supports CraftBukkit 1.7.9? No problem, just search Shodan:

port:25565 minecraft CraftBukkit 1.7.9

The banner returns a bunch of cool information that can let us understand how most people setup/ configure their Minecraft server.

To get started, lets download the data using the shodan command-line tool:

shodan download --limit -1 minecraft-data "port:25565 minecraft after:01/03/2015"

The above command will download all available data on Minecraft servers that were discovered after March 1st, 2015. This means they were recently found and should be representative of what's currently being used. I was curious to see how many players most of the servers support:

shodan parse --fields data minecraft-data.json.gz | \ # Grab the data sed -e 's/ maximum.*//' -e 's/.* //' | \ # Extract the maximum players sort | \ # Sort the number of max players uniq -c | \ # Count the occurrences for the max player setting sort -rn | \ # Sort the resulting breakdown head -20 # Get the top 20

The above command takes the Minecraft data, extracts the number of maximum players that the server supports and then sorts/ counts it a bunch of different ways to get the following data:

42933 20 20142 4 11881 10 7856 6 5565 8 3166 5 1885 30 1885 100 1778 50 1707 15 1299 12 1029 2 908 40 728 3 714 16 646 24 600 200 572 25 453 32 421 60

This means that 42,000 servers allow a maximum of 20 players, which is by far the most popular setting and also happens to be the default. Second most popular is allow just 4 players to connect, followed by 10 players. Most of the numbers in the top 20 look reasonable, but there are plenty of outliers:

8 servers allowed "-1" number of maximum players - I'm guessing they were trying to say "unlimited", but -1 isn't actually a valid value

4 people allow up to 1,000,000,000. When the Shodan crawlers connected there weren't any people online, so these aren't the official servers that expect tons of players.

52 servers are 1337

In terms of Minecraft versions, the distribution is as follows:

22824 1.8 18829 1.7.10 15512 1.8.3 14974 1.8.1 12177 Spigot 1.8 7046 CraftBukkit 1.7.9 3764 Spigot 1.7.10 3661 CraftBukkit 1.8 2803 CraftBukkit 1.7.2 1893 cauldron,craftbukkit,mcpc,fml,forge 1.7.10

These are the Top 10 Minecraft Versions on the Internet as of March 2015. The most popular server remains vanilla Minecraft version 1.8, followed by a variety of other vanilla versions. At 5th place we have the Spigot high performance Minecraft server with a bit more than 12,000 deployments.

I used a slightly modified version of the earlier command to get the breakdown:

shodan parse --fields data minecraft.json.gz | \ sed -e 's/.*Version: //' -e 's/ (.*//' | \ sort | \ uniq -c | \ sort -rn | \ head -10

Next time you're looking for a new Minecraft server to visit, give Shodan a try to find what you want :)