Two free servers, one proxy operator: what August 2026 taught us

In August 2026, twice in the same week, the same person used Alama's free offers to turn a game server into a relay for other people's traffic. Nothing belonging to our customers was read or taken. We are writing this down because hosting is a trust business, and trust is built on telling what happened, not on pretending nothing ever does.

What they were after

The goal was not to steal data. It was to borrow our network. The uploaded code installed a proxy and opened an outbound tunnel to a public tunnelling service, so strangers could send their traffic through a server hosted in France. Because the tunnel starts from the inside, no port needs to be open: blocking incoming traffic changes nothing.

The risk that matters for a host is what such a relay can reach. A proxy with no rules can knock on the other machines of the network it lives in. That is the part we treated as urgent.

The first attempt: a bot that was not a bot

The first account ordered the free Discord bot offer. The support ticket was believable, asking how to change the start command. The server's name and a web page served on its port told the story of a harmless feed bot. The code told another one: no feed, no Discord, and instead the download of a proxy and a tunnel client.

The second attempt: a real Minecraft server with one file changed

A few days later, a new account took the free Minecraft offer and uploaded its own server file. It was a genuine open-source lobby server, complete and working, with a single class out of ninety-five replaced. The replacement started the proxy first, then the real server, then cleared the console after thirty seconds. "My Minecraft server works" was true, and proved nothing.

This time the payload did run before we stopped it.

What we did

• We stopped and removed both servers and closed the accounts.
• We reported the tunnel and the download host to the provider that served them, and the domain to its registrar. The download host was cut at the source.
• We took the second sample apart, down to the one modified class, and shared it with people who study this kind of code.

What it taught us

• Uploaded files cannot be judged by their name or by what they visibly do. A complete, working program with one altered file passes every surface check.
• The useful control is on the way out. A free server has little reason to reach the whole Internet; limiting where it can connect is what stops a relay, not firewall rules on the way in.
• Keep a copy before deleting. We removed the second server before copying its files, and lost the answer to a question we still have.

If you run a server with us and something in this story worries you, write to us at contact@alama.host.