Like the other commenter said, I dunno how the heck the griefers find the servers - but if it’s on the open Internet, they do.

I set up a server for me an a handful of mates - advertised the address nowhere. They told nobody. A month in a friend and I were playing as usual, and a player with a Russian username joined. I’m like “uh hi who are you?”. They stayed another minute or two while saying nothing, then left.

I think they left when they realized i had an anti-griefer permissions mod that protects the blocks in an area around the spawn point from being modified (its called ‘Flan’). So they joined, saw the server had some protections, and decided it wouldn’t be much fun for them.

Whitelist immediately enabled - no more random Russians.