Bungee IP forwarding does not work like expected when sending a IP:PORT string. Spigot cannot resolve the IP and it stays unresolved, but continues to allow the client to join.
The console output looks like this:
This is clearly not intended behaviour. Having a quick looking into the Spigot patches, I noticed that there is a regex which allows a ":" in the IP part of the forwarded information, but this part gets matched and directly feed into java.net.InetSocketAddress here. Another strangeness here is also the port that gets feed into java.net.InetSocketAddress. This is the proxy's port to the server and not the port of the client to the proxy.
Sending no IP (this means nothing between the null characters) also allows the client to join:
Maybe I'm missing something and this is necessary?
I would hope that this gets changed so that I can also forward the client's port. In my opinion, it looks like that this was initially an intended "feature" and someone just forgot to handle this case and everyone else just ended up only sending the IP without the port for this reason.
Fun fact: With a player based IP-ban, you can actually ban the "<unresolved>" IP