__ __ _ _____ ____ __
| \/ | (_) | __ \ / __ \ /_ |
| \ / | ___ _ ___| | | |/ / _` |_ _| |
| |\/| |/ _ \| |/ _ \ | | | |_| | | | | | |
| | | | (_) | | __/ |__| |\__,_| | |_| |_|
|_| |_|\___/|_|\___|_____/ \___/ \___/(_)
Passive client-side mod/hack detection engine + network-level anti-ESP for Paper/Folia 26.x
MoidAC is a passive detection engine that silently fingerprints players on join and on-demand using invisible sign-based vectors, combined with a packet-level anti-ESP to hide underground content from x-ray/ESP hacks. Players never notice it running.
Built on the original CheckHacks by Branduzzo, then rewritten, extended, and set on fire until it became this.
| Category | What it does |
|---|---|
| 🕵️ Mod Detection | Invisible signs with mod-specific translation keys — modded clients leak themselves |
| 🔤 Language Detection | Detects the client's game language via sign text rendering |
| 🏷️ Brand Detection | Intercepts minecraft:brand to catch hacked clients faking vanilla |
| 📡 Plugin Channel Detection | Reads minecraft:register to detect mod loaders (Fabric, Forge, etc.) |
| 🛡️ Anti-ESP | Strips underground blocks, entities, particles, and light data at the packet level |
| ⚡ Folia-Native | Region-aware entity/location schedulers, fully thread-safe |
| 🤖 Anticheat Hooks | Auto-triggers checks when Grim/Vulcan/Spartan flags a player |
| 📊 SQLite Database | All scan results persisted with per-mod detail |
| 🔔 Discord Webhooks | Formatted detection reports with emoji status |
| 🌍 Multi-Language | 10 language files (en, it, br, de, es, fr, lolcat, ru, uwu) |
| 🔌 Plugin APIs | PlaceholderAPI support, MiniMessage formatting |
The server sends fake signs containing mod-specific translation keys (e.g., key.meteor-client.open-gui). Modded clients resolve these differently than vanilla:
- Vanilla client: Shows the raw key string (e.g.,
key.meteor-client.open-gui) - Modded client: Resolves the key to the mod's localized string (e.g.,
Open Meteor GUI)
The entire process is invisible — the player never sees a sign appear. We exploit a fundamental rendering difference that cannot be patched without breaking the game's sign system.
Three detection modes:
| Mode | How it works |
|---|---|
| METEOR | Uses Meteor's specific translation key format (key.meteor-*) |
| TRANSLATE | Uses generic key.* translation keys that mods override |
| KEYBIND | Uses keybind entries that mods register |
Reads minecraft:register packets at login to detect mod loaders (Fabric, Forge, NeoForge, Quilt) and cheat clients that register their own plugin channels (Meteor, Wurst, etc.).
Intercepts minecraft:brand plugin messages to identify clients leaking their real brand or attempting to spoof "vanilla".
Combines all of the above to fingerprint the client type — currently recognizes VANILLA, FABRIC, FORGE, NEOFORGE, QUILT, LUNAR, BADLION, LABYMOD, METEOR, WURST, ARISTOIS, IMPACT, LIQUIDBOUNCE, INERTIA, LAMBDA, RUSHERHACK, BARITONE, BLEACHHACK and more.
MoidAC includes a network-level anti-ESP that prevents x-ray resource packs, wallhacks, and entity ESP from seeing underground content. It operates at the packet level using PacketEvents.
Three components working together:
Intercepts every CHUNK_DATA packet sent to players. When a player is above reveal-at-y, chunk sections below hide-below-y are modified in-flight:
- Uniform Mode (recommended): Replaces ALL blocks below threshold with a single configurable block (e.g.,
minecraft:deepslate). UsesSingletonPalette— extremely performant, no per-block iteration. - Selective Mode: Only processes the bottommost chunk section, replacing specific blocks (ores → deepslate, water → stone, etc.) defined in a configurable map. Slightly more CPU but preserves the natural look of non-target blocks.
Tile entities (chests, spawners, etc.) below the threshold are stripped. Light data is masked to prevent cave-location inference.
Cancels individual packets referencing content below the threshold:
- Particles (cave ambient particles, portal particles)
- Block changes, multi-block changes
- Block entity data (tile entity packets)
- Block actions (chest opening, door sounds)
- Block break animations
- Entity spawns (mobs, items, item frames, players)
- Entity metadata/equipment updates (for already-hidden entities)
When a player descends below reveal-at-y, all cached real chunks are re-sent instantly. When they go back above, the masked versions are re-sent. Instant — no progressive reveal.
hide-below-y: 64 # Blocks below Y=64 are masked
reveal-at-y: 20 # Players below Y=20 see real chunks
uniform-mask: true # Replace all hidden blocks with one block
uniform-block: "minecraft:deepslate" # The fake blockConfigured in checkhacks.yml — add your own without plugin updates.
| Mod | Detection Mode |
|---|---|
| Meteor Client | METEOR |
| LiquidBounce | TRANSLATE |
| Freecam | KEYBIND |
| Wurst Client | KEYBIND |
| XRay (Fabric) | KEYBIND |
| ChestESP | KEYBIND |
| KillAura (Fabric) | KEYBIND |
| AutoFish | KEYBIND |
| Lumina | KEYBIND |
| AutoSwitch | KEYBIND |
| BleachHack | TRANSLATE |
| Aristois | TRANSLATE |
| Coffee Client | TRANSLATE |
| World Downloader | TRANSLATE |
| AutoClicker (Fabric) | TRANSLATE |
| AntiAFK | TRANSLATE |
| Auto Clicker (p1k0chu) | KEYBIND |
| Baritone | KEYBIND |
| Impact | TRANSLATE |
| Inertia | TRANSLATE |
| Kami Blue | TRANSLATE |
| RusherHack | TRANSLATE |
| Lambda | TRANSLATE |
| OpSec | TRANSLATE |
| NoChatReports | TRANSLATE |
| Xaero's Minimap | KEYBIND |
| Xaero's World Map | KEYBIND |
| JourneyMap | KEYBIND |
| Tweakeroo | KEYBIND |
| ...and more |
All commands are under the unified /moidac dispatcher:
| Command | Aliases | Permission | Description |
|---|---|---|---|
/moidac moddetect <player> [mods...] |
— | moidac.check |
Check a player for hack mods |
/moidac checklang <player> [langs...] |
— | moidac.checklang |
Detect client language |
/moidac alerts |
— | moidac.alerts |
Toggle alert messages |
/moidac antiesp reload |
— | moidac.antiesp.reload |
Reload anti-ESP config |
/moidac reload |
chreload, moidacreload |
moidac.reload |
Reload all configs & messages |
/moidac |
checkhacks, chalerts, checklang, alerts, etc. |
moidac.use |
Root command with tab completion |
| Permission | Default | Description |
|---|---|---|
moidac.use |
OP | Use /moidac commands |
moidac.check |
OP | Check a player for mods |
moidac.reload |
OP | Reload configuration |
moidac.alerts |
OP | Receive toggleable alerts |
moidac.checklang |
OP | Check player language |
moidac.antiesp.bypass |
OP | Bypass anti-ESP (see real chunks) |
moidac.antiesp.reload |
OP | Reload anti-ESP configuration |
moidac.* |
— | All permissions (wildcard) |
| Dependency | Required? | Purpose |
|---|---|---|
| Paper 26.x / Folia 26.x | ✅ Required | Server software (1.21.11 API) |
| Java 21+ (25 recommended) | ✅ Required | Runtime |
| PacketEvents 2.13.0+ | Packet interception for chunk masking, entity/particle filtering, light data masking | |
| PlaceholderAPI | ❌ Optional | Placeholder resolution in messages |
| SQLite JDBC | ✅ Bundled | Embedded database for scan results |
| Gson | ✅ Bundled | JSON serialization |
The anti-ESP system needs to intercept and modify network packets before they reach clients:
CHUNK_DATApackets are rewritten with masked block palettesPARTICLE,BLOCK_CHANGE,ENTITY_SPAWNpackets are cancelled for content below the threshold- Light data arrays are stripped to hide cave locations
Bukkit's API doesn't expose packet-level access, so PacketEvents fills that gap. It's a softdepend — the mod detection and language check features work without it; only anti-ESP requires it.
- JDK 21+ (Java 25 recommended for Minecraft 26.x)
- Git
# Clone
git clone https://github.com/yourusername/MoidAC.git
cd MoidAC
# Build (Gradle wrapper included)
./gradlew build
# Output: build/libs/MoidAC-<version>.jar- Drop
MoidAC-<version>.jarinto your server'splugins/folder - (Optional, for anti-ESP) Drop PacketEvents jar into
plugins/ - Restart or reload
- Edit
plugins/MoidAC/config.ymlto your liking - Run
/moidac reloadto apply changes
The plugin generates commented config files on first run:
| File | Purpose |
|---|---|
config.yml |
Master config: discord webhooks, brand-check action, bedrock skip, language |
checkhacks.yml |
Hack definitions (31+), auto-check settings, webhook/command triggers |
checklang.yml |
Language detection: 63 locale mappings, auto-check settings |
antiesp.yml |
Anti-ESP: thresholds, mask modes, block replacements, world whitelist |
lang/ |
Message files in 10 languages (MiniMessage format) |
PRs, issues, and feature requests are welcome. If you have a mod to add or a detection method to improve, open a PR or issue.
MIT © MoidAC Team, Branduzzo