Ultimate-antibot-spigot

version: 4.3
#   _    _ _ _   _                 _                        _   _ _           _
#  | |  | | | | (_)               | |           /\         | | (_) |         | |
#  | |  | | | |_ _ _ __ ___   __ _| |_ ___     /  \   _ __ | |_ _| |__   ___ | |_
#  | |  | | | __| | '_ ` _ \ / _` | __/ _ \   / /\ \ | '_ \| __| | '_ \ / _ \| __|
#  | |__| | | |_| | | | | | | (_| | ||  __/  / ____ \| | | | |_| | |_) | (_) | |_
#  \____/|_|\__|_|_| |_| |_|\__,_|\__\___| /_/    \_\_| |_|\__|_|_.__/ \___/ \__|
#
#For any question / problem please open a ticket on my discord server,
#here is the link: https://discord.gg/vgsjmbXez3

# (!) DEBUG MODE (!)
#Setting it to true will allow me to help you better during the assistance however
#it results in a spam of useless messages in the console :(
debug: false

#UltimateAntibot V4 brings with it great improvements, ways of adapting the antibot
#to the performance of the machine based on its performance have been created.
detect-server-performance: true

# (!) WARNING (!)
# If set to true it will be able to calculate the time that the server takes to do all its operations!
# This involves creating a thread that could burden low-powered servers!
# It is recommended to use it only in dedicated servers or in vps with more than 8 cores!
# Use it at your own risk!
enable-latency-thread: false

# (!) NOTIFICATION (!)
#Enable bossbar notification on attack (1.9+)
enable-bossbar-automatic-notification: true
#Disable notifications after an attack?
disable-notifications-after-attack: false

# (!) DISABLE CONSOLE ATTACK MESSAGE (!)
#
#If set to true, when you receive an attack on your server the
#console will not write any warning messages (referring only to UAB messages)
disable-console-attack-message: false

# (!) AUTO-PURGER (!)
#By default all auto-purge checks are performed maximum once every 5 minutes according to the set conditions below
auto-purger:
  #in the current case, when the blacklist goes up 15k+ IPs and there is no attack it will be cleared
  #in the second case (AFTER_ATTACK), after an attack if the blacklist contains 15k+ IPs will be cleared
  blacklist:
    type: LIMIT #AFTER_ATTACK
    value: 15000 #amount of ip
    enabled: true
  #same as blacklist
  whitelist:
    type: LIMIT
    value: 2500 #amount of ip
    enabled: false
  #It will delete logs older than 15 days
  logs:
    value: 15 #days
    enabled: true

#Antibotmode has the utility of mitigating the attack, blacklisting + ip possible,
antibotmode:
  #Duration of the anti-botmode when activated
  keep: 15 #seconds
  #If there are 10 connections in 1 second the antibot mode will be activated!
  trigger: 10
  #Slowmode duration
  keep-slow: 25
  #disconnect joined players
  disconnect: true

#Pingmode allows player connections to your server!
pingmode:
  #Duration of the ping-mode when activated
  keep: 10
  #How many pings in 1 second does it take to activate the protection?
  trigger: 100
  #MotdKiller Protection
  #Send the server logo during a ping attack?
  send_info: false

#Works Only on Bungeecord Waterfall ect...
packetmode:
  #Duration of handshakemode
  keep: 15
  #How many blocked packets in 1 second for enable?
  trigger: 15
  #if the handshake has an invalid protocol do I have to blacklist it?
  blacklist-invalid-protocol: true

#Minimum online time to be whitelisted
playtime_for_whitelist: 10 #minutes

taskmanager:
  clearcache: 60 #seconds
  auth: 300 #seconds
  register: 120 #seconds
  update: 15 #seconds

checks:
  firstjoin:
    #enable firstjoin
    enabled: true
  #This check checks the number of accounts entered by the same ip within 60 seconds during antibot mode
  namechanger:
    #Clear cache time
    time: 200
    #max accounts to blackist
    limit: 3
    #enable?
    enabled: true
  #If an ip joins 35 times in 300 seconds
  superjoin:
    #Clear cache time
    time: 300
    #max joins in 300 seconds to get blacklisted
    limit: 35
    #enable?
    enabled: true
  auth:
    #Clear cache time
    time: 300
    #Allows users to whitelist
    #Through min-max ping
    ping: 4-7
    #Min max TimerCheck
    timer: 3-7
    #When the time for verification runs out,
    #you have 1.3 second to join
    between: 1300 #milliseconds
    #BlackList enable condition
    percent: 90
    #If player fail this check 25 times will be blacklisted
    maxfails: 25
    #If a player has to ping the verification,
    #the non-verifying players will have a counter of the times they pinged the
    #server to enter!
    #On bungeecord will use protocol name
    #On spigot will use the motd
    #Editable in messages.yml
    ping_interface: true
  legalname:
    #All nicknames with a length less than or equal to 16 and containing
    #characters such as "_" and "." the point is supported for geyser players to enter the server
    #If you use a different character such as a "," just substitute it at the point in the expression below!
    name-regex: "[a-zA-Z0-9_.]*"
    enabled: true
  invalidname:
    #If a player who enters contains one of the following strings in his name he will be blocked!
    invalid:
      - "MCSTORM_IO"
      - "MC_BOT_IO"
    blacklist: true
    enabled: true
  strange-register:
    #The second string after the command will be taken as the password
    listen:
      - "/register"
      - "/reg"
      - "/l"
      - "/login"
    limit: 3 #if 3 players uses the same password will be blacklisted
    blacklist: true
    antibotmode: true
    enabled: true
  slowjoin:
    #This check will check if a player sends a certain packet,
    #which the bots do not send, to 5 bots that do not send it
    #in 60 it will perform the various actions
    #WARNING
    #If you see any abnormal kicks on your server it is recommended to disable it!
    packet:
      time: 120 #seconds
      trigger: 5
      #dev only
      condition: 0
      blacklist: false
      kick: true
      antibotmode: true
      enabled: true
    #if from same ip 4 accounts are online
    #will perform the various actions
    account:
      time: 0 #ignored here
      trigger: 4
      condition: 0 #ignored here
      blacklist: true
      kick: true
      antibotmode: true
      enabled: true


######################################
#               FIREWALL             #
######################################
#This is the firewall section, to work correctly it requires the IPSet and IPTables service,
#otherwise the hook will not be activated.
#It will only work if the start script has permissions to execute the commands, it may not
#work on sites that offer minecraft servers as a pterodactyl panel (aternos, elixirnode, server.pro, etc ...)

#Removing / changing one of these commands in case you don't know what
#you are doing is highly discouraged and could cause lag problems.
#
#Positive points:
#After about 5 minutes of attack the number of connections per second will be lowered to 50/100
#The time depends on the number of IPs to be blacklisted
#
#Negative points:
#Slower on spigot!
#There will be an increase of CPU usage during ip blacklisting (Especially on low-powered servers)
firewall:
  enabled: false
  #Unique name of IPSet
  ip-set-id: "uab_blacklist"
  #The duration of the blacklist for each ip
#   timeout: 0 seconds, 0 = cancels on server restart or on blacklist clear (with command)
  #Also clear the firewall blacklist when the blacklist is reset by command?
  reset-on-blacklist-clear: true
  #Commands executed to load the hook
  setup-commands:
    - "sudo ipset create %set% hash:ip %options% %t%"
    - "sudo iptables -N UltimateAntiBot"
    - "sudo iptables -F UltimateAntiBot"
    - "sudo iptables -A UltimateAntiBot -p tcp -m set --match-set %set% src -j DROP"
    - "sudo iptables -A INPUT -p tcp -j UltimateAntiBot"
  shutdown-commands:
    - "sudo iptables -F UltimateAntiBot"
    - "sudo iptables -D INPUT -p tcp -j UltimateAntiBot"
    - "sudo iptables -X UltimateAntiBot"
    - "sudo ipset destroy %set%"
  #Command executed to blacklist an ip
  blacklist-command: "sudo ipset add %set% %ip%"
  un-blacklist-command:
    - "sudo ipset del %set% %ip%"

#######################################
#                 VPN                 #
#######################################

#Another anti vpn check (free) provided by: https://ip-api.com/
#Disable this check if you are using proxycheck.io
ip-api:
  enabled: true

#This check allows you to verify your users during bot attacks!
#The site offers a free plan that you can access by signing up which gives you access to 1k requests per day.
#Each check will cost you 1 request and at the end of the daily requests you will have to wait for the next day,

#provided by: https://proxycheck.io/
proxycheck:
  #if key is not valid proxycheck is disabled (without errors in console (unless you have active debugging!))
  api-key: "enter-here-your-key"

#######################################
#              FILTER                 #
#######################################

#This is to hide messages when players are kicked by the antibot
#usually it's best to keep it turned on to remove spam from the console but
#you can turn it off in case you need to debug something or if you want to see these message.
hide-spigot-disconnect-message: true

#Custom Message filter only works during a bot/packet/ping attack
attack-filter:
  - "Another plugin has cancelled the connection for" #luckperms on spigot
  - "The UUID the player is connecting with now is NOT Mojang-assigned" #luckperms on bungeecord

#Custom message console filter (works 24h/7)
persistent-filter: []