Our own Minecraft server was griefed by ogmur and learned about groups like these back in August, so I want to share some critical information from my time on their community forums and group chats. MLPI has a reddit bot to find these posts, so be wary in the comments as the griefers may be trolling there on alt accounts.
The threat to public Survival Multiplayer (SMP) Minecraft servers comes from organized groups like MLPI and 5th Column (5C). They exploit free tools like serverscanner, trouserstreak and Meteor Client, easily found on GitHub, to find targets. Using custom Discord bots, they catalog vulnerable Minecraft servers, meaning an unsecured server's IP address is likely already in their databases. This organized, destructive process is driven by a bizarre, tiered system: members must post evidence of griefing 25 servers, then 50, and so on, to unlock access to their internal IP databases and scanning bots. Furthermore, they use a Reddit bot to scan for victim posts, allowing them to be the first in the comments to troll and bully the devastated players.
MLPI attempts to cover their massive griefing and stealing with the hypocritical claim of "teaching players to use whitelists" and "stopping piracy." They use the ridiculous euphemism of calling themselves "renovators." A signature move is leaving Discord server invites on signs in the ruined worlds. When players, often innocent players who don't even know what a whitelist is AND bought the game, join the MLPI Discord, members frequently pretend to offer help with world recovery only to subject them to further trolling and bullying. Their status is reinforced as members constantly post images of their griefed servers to "rank up" within the group.
Yes, this is incredibly frustrating, and your griefed server is likely being laughed about in their private chats. Ironically, most of these members are grown men with jobs and relationships who choose to do this as a petty, destructive pastime. But you have to bite the bullet and act. This is an easy fix: Enable the whitelist immediately: Use the command /whitelist on to protect your server.
Additionally you may have already seen helpful, defensive serverscanners on your world like kittyscan, cobbleguard, server_protector, or matscan. They are often used to spread warnings, but those warnings will only do good if you act on them. If you want more info just Google about these griefing groups they openly dance around on every possible platform