__ ___ _ _____ ______
/ |/ /___ (_)___/ / | / ____/
/ /|_/ / __ \/ / __ / /| |/ /
/ / / / /_/ / / /_/ / ___ / /___
/_/ /_/\____/_/\__,_/_/ |_\____/
Passive client-side mod/hack detection engine + network-level anti-ESP + FakeLag detection for Paper/Folia 26.x
MoidAC silently fingerprints players on join and on-demand using invisible sign-based vectors, combined with a packet-level anti-ESP to hide underground content from x-ray/ESP hacks, and a packet-timing analysis engine to detect FakeLag cheats. Everything runs passively — players never know they're being checked.
| Category | Description |
|---|---|
| Mod Detection | Invisible signs with mod-specific translation keys — modded clients leak themselves |
| Language Detection | Detects client game language via sign text rendering |
| Brand Detection | Intercepts minecraft:brand to catch hacked clients faking vanilla |
| Plugin Channel Detection | Reads minecraft:register to detect mod loaders |
| Anti-ESP | Strips underground blocks, entities, particles, and light data at the packet level |
| FakeLag Detection | Packet-timing analysis with three detection modes (all/action/movement) to catch FakeLag cheats |
| Folia-Native | Region-aware entity/location schedulers, fully thread-safe |
| Anticheat Hooks | Auto-triggers checks when Grim/Vulcan/Spartan flags a player |
| SQLite Database | All scan results persisted with per-mod detail |
| Discord Webhooks | Formatted detection reports |
| Multi-Language | 8 language files for server messages |
| Plugin APIs | MiniMessage formatting |
The server sends fake signs containing mod-specific translation keys. Vanilla clients show the raw key; modded clients resolve it to the localized string. The player never sees a sign — you detect them without them knowing.
Modes:
- METEOR — Uses keys specific to Meteor Client and its derivatives
- TRANSLATE — Generic translation overrides that mods commonly hook into
- KEYBIND — Key binding entries that mods register, detectable even from vanilla key changes
Reads minecraft:register packets at login to detect mod loaders (Fabric, Forge, NeoForge, Quilt) and cheat clients before the player even spawns.
Intercepts minecraft:brand to identify real client brands vs. spoofed "vanilla". Many hacked clients lie about their brand — this flags mismatches.
Combines all methods to fingerprint clients into known types. Supports: VANILLA, FABRIC, FORGE, NEOFORGE, QUILT, LUNAR, BADLION, LABYMOD, METEOR, WURST, ARISTOIS, IMPACT, LIQUIDBOUNCE, INERTIA, LAMBDA, RUSHERHACK, BARITONE, BLEACHHACK and more.
Passive packet-timing analysis that runs three independent detection streams on every packet:
- All mode — Flags when every packet type stops arriving (full FakeLag freeze). Catches players using FakeLag to freeze their position completely.
- Action mode — Detects selective FakeLag where only non-movement packets (swing, use-item, drop, etc.) are queued while movement packets leak through. Catches players who want to keep moving but freeze interactions.
- Movement mode — Catches blink/FakeLag variants that queue movement packets but let actions through. The inverse of action mode.
Each mode has independently configurable gap threshold (ms), burst threshold (ms), and burst flag count in fakelag.yml. A cumulative VL system handles repeat offenders with configurable punishment commands.
Network-level anti-ESP preventing x-ray resource packs, wallhacks, and entity ESP. Operates at the packet level via PacketEvents.
Chunk Masking — Intercepts CHUNK_DATA packets and replaces sections below hide-below-y in-flight:
- Uniform Mode (recommended) — Replaces all blocks below threshold with a configurable block. Uses singleton palette for maximum performance.
- Selective Mode — Replaces specific blocks (ores, water, etc.) only at the bottommost section.
Tile entities below the threshold are stripped. Light data is masked to prevent cave-location inference.
Packet Filtering — Cancels particles, block changes, block entities, entity spawns, and metadata packets below the threshold before they reach the client.
Proximity Reveal — When a player descends below reveal-at-y, real chunks are re-sent instantly so they can see normally underground.
🎯 Detectable Mods (31+)
Configured in checkhacks.yml — add your own without plugin updates.
| Mod | Mode |
|---|---|
| Meteor Client | METEOR |
| LiquidBounce | TRANSLATE |
| Freecam | KEYBIND |
| Wurst Client | KEYBIND |
| XRay (Fabric) | KEYBIND |
| ChestESP | KEYBIND |
| KillAura (Fabric) | KEYBIND |
| AutoFish | KEYBIND |
| Lumina | KEYBIND |
| AutoSwitch | KEYBIND |
| BleachHack | TRANSLATE |
| Aristois | TRANSLATE |
| Coffee Client | TRANSLATE |
| World Downloader | TRANSLATE |
| AutoClicker (Fabric) | TRANSLATE |
| AntiAFK | TRANSLATE |
| Auto Clicker (p1k0chu) | KEYBIND |
| Baritone | METEOR |
| Impact | TRANSLATE |
| Inertia | TRANSLATE |
| Kami Blue | TRANSLATE |
| RusherHack | TRANSLATE |
| Lambda | TRANSLATE |
| OpSec | KEYBIND |
| NoChatReports | KEYBIND |
| Xaero's Minimap | TRANSLATE |
| Xaero's World Map | KEYBIND |
| JourneyMap | KEYBIND |
| Tweakeroo | KEYBIND |
| ...and more |
All commands under /moidac:
| Command | Permission | Description |
|---|---|---|
/moidac moddetect <player> [mods...] |
moidac.check |
Check a player for specific mods or all known mods |
/moidac checklang <player> [langs...] |
moidac.checklang |
Detect client language |
/moidac alerts |
moidac.alerts |
Toggle alert messages on/off |
/moidac antiesp reload |
moidac.antiesp.reload |
Reload anti-ESP configuration |
/moidac reload |
moidac.reload |
Reload all configs, messages, and detection modules |
/moidac version |
moidac.use |
Show plugin version |
/moidac |
moidac.use |
Root command with tab completion |
🔐 Permissions
| Permission | Default | Description |
|---|---|---|
moidac.use |
OP | Use /moidac |
moidac.check |
OP | Check players for mods |
moidac.reload |
OP | Reload configuration |
moidac.alerts |
OP | Receive alerts |
moidac.checklang |
OP | Check player language |
moidac.antiesp.bypass |
OP | Bypass anti-ESP |
moidac.antiesp.reload |
OP | Reload anti-ESP |
moidac.* |
— | Wildcard |
📦 Requirements
| Dependency | Required | Purpose |
|---|---|---|
| Paper 26.x / Folia 26.x | ✅ | Server software (1.21.11 API) |
| Java 21+ (25 recommended) | ✅ | Runtime |
| PacketEvents 2.13.0+ | Packet interception for chunk masking, entity/particle filtering, light data masking, and packet-timing analysis | |
| SQLite JDBC | ✅ Bundled | Embedded database |
| Gson | ✅ Bundled | JSON serialization |
PacketEvents is a soft dependency — mod detection and language checks work without it. Anti-ESP and FakeLag detection require it.
🏗️ Building
git clone https://github.com/yourusername/MoidAC.git
cd MoidAC
./gradlew build
# Output: build/libs/MoidAC-<version>.jarInstall:
- Drop the jar into
plugins/ - (Optional, required for anti-ESP/FakeLag) Drop PacketEvents jar into
plugins/ - Restart or reload
- Edit
plugins/MoidAC/config.yml - Run
/moidac reload
Generated on first run (all files in plugins/MoidAC/):
| File | Purpose |
|---|---|
config.yml |
Webhooks, brand-check action, bedrock skip, language |
checkhacks.yml |
Hack definitions, auto-check settings, webhook/command triggers |
checklang.yml |
Language detection: 63 locale mappings, auto-check settings |
antiesp.yml |
Anti-ESP: thresholds, mask modes, block replacements, world whitelist |
fakelag.yml |
FakeLag detection: per-mode thresholds, VL limits, grace period, punishment |
lang/ |
Message files in 8 languages (MiniMessage format) |
MIT Dio_M, opencode