[INDL] MOD-HACK DETECTED: Server-Side Mod Integrity Scanner

Protect your server from hack clients. [INDL] MOD-HACK DETECTED is a powerful, server-side anti-cheat mod that scans every player's installed mods and classifies them using a 5-Level Trust System. From known hack clients like Wurst or Meteor to unknown suspicious JARs — nothing gets past unnoticed.

🚀 Why choose [INDL] MOD-HACK DETECTED?

Most anti-cheat solutions only detect known cheats. [INDL] MOD-HACK DETECTED goes further — it performs deep JAR analysis, scans for suspicious classes and packages, checks SHA-256 hashes against a blacklist database, and classifies every single mod a player has installed.

Even if a cheater renames their hack client, the hash stays the same. Even if the hash is unknown, the heuristic engine catches suspicious classes like KillAura, Nuker, or ESPModule.

🛡️ 5-Level Trust Classification System

Every mod installed by a player is classified into one of 5 trust levels, giving admins clear visibility into potential threats:

Level	Name	Description
L1 🔵	Server Core	Mod exists in the server's `/mods` folder. Auto-whitelisted.
L2 🟢	Verified Client	Manually approved by an admin via SHA-256 hash. Trusted.
L3 🟡	Unknown (Low Risk)	Unknown mod with no suspicious indicators. Monitor.
L4 🟠	Unknown (High Risk)	Unknown mod with suspicious classes, packages, or keywords detected.
L5 🔴	Confirmed Threat	Hash matches a known hack mod in the blacklist database.

How Classification Works

Player Joins → Client sends mod list + hashes
                    ↓
            ┌─ Hash in blacklist?     → 🔴 L5: Confirmed Threat
            ├─ Hash = server mod?     → 🔵 L1: Server Core
            ├─ Hash in whitelist?     → 🟢 L2: Verified Client
            ├─ Suspicious content?    → 🟠 L4: Unknown High Risk
            └─ None of the above      → 🟡 L3: Unknown Low Risk

🔍 Deep Detection Engine

SHA-256 Hash Matching

Each mod file has a unique SHA-256 fingerprint. Renaming a hack client won't help — the hash stays the same.

WurstClient-7.0.jar       → Hash: "e46ced73..."
TotallyLegitMod.jar       → Hash: "e46ced73..." ✅ DETECTED!

Heuristic JAR Analysis

When a mod's hash isn't in any list, the engine scans inside the JAR file for:

Suspicious classes: KillAura, Nuker, SpeedHack, Xray, ESPModule, AimBot, FreeCam, WallHack, TriggerBot, NoFall…
Suspicious packages: net.wurstclient, meteordevelopment.meteorclient, net.ccbluex.liquidbounce, org.rusherhack…
Blacklisted keywords: wurst, meteor-client, killaura, xray, aimbot, forgehax, wallhack…
Blacklisted authors: Known hack mod developers

CamelCase-Aware Matching

The class scanner uses intelligent token matching — ESP matches ChestESP or ESPModule but does NOT match Respawn or Response. This dramatically reduces false positives.

🖥️ Admin Panel (GUI)

Open the Admin Panel with /hkd gui for a real-time visual overview of all players and their mods.

Features:

Player list with color-coded trust badges (L1-L5)
Strike counter and ban status per player
Per-mod inspector showing hash, filename, risk level, and reason
One-click actions: Whitelist, Blacklist, Remove from WL/BL
Scan, Kick, and Ban buttons directly from the panel
Mutually exclusive lists — whitelisting auto-removes from blacklist and vice versa
Instant UI refresh — changes reflect immediately without manual rescanning

⚡ Key Features

✅ Automatic Scans — Runs on join and at configurable intervals
✅ Real-Time Admin Alerts — OPs receive detailed notifications with mod names and reasons
✅ Progressive Strike System — Fair warnings before kick/ban
✅ SHA-256 Hash Blacklist — Instantly detect known hack mods
✅ Deep JAR Analysis — Scan class files, packages, and metadata inside JARs
✅ Auto-Whitelist Server Mods — Server-side mods are trusted automatically (Level 1)
✅ Manual Hash Whitelist — Approve specific client mods by hash (Level 2)
✅ Admin GUI Panel — Visual management with one-click approve/block actions
✅ Zero Lag — Async scanning with configurable JAR size limits
✅ Fully Configurable — Keywords, classes, packages, authors, and response actions

🛡️ Progressive Strike System

Instead of immediately kicking players, the mod can use a fair, progressive warning system:

Strike	Action
1st	⚠️ Warning + Admin notification
2nd	🔴 Auto-kick (configurable)
3rd	🚫 Auto-ban (configurable)

Strikes reset automatically after a configurable time period (default: 1 week).

🛠️ Commands & Permissions

Command	Alias	Description
`/hackdetected help`	`/hkd help`	Show help menu
`/hackdetected status`	`/hkd status`	View mod status and configuration
`/hackdetected stats`	`/hkd stats`	View global detection statistics
`/hackdetected list`	`/hkd list`	List all scanned players with trust levels
`/hackdetected inspect <player>`	`/hkd inspect`	Detailed mod list for a player
`/hackdetected scan <player>`	`/hkd scan`	Force an immediate rescan on a player
`/hackdetected scanall`	`/hkd scanall`	Force rescan on all online players
`/hackdetected whitelist list`	`/hkd whitelist list`	View all whitelisted mod hashes
`/hackdetected whitelist add <hash>`	`/hkd whitelist add`	Add a mod hash to the whitelist
`/hackdetected whitelist remove <hash>`	`/hkd whitelist remove`	Remove a mod hash from the whitelist
`/hackdetected blacklist list`	`/hkd blacklist list`	View all blacklisted hashes and names
`/hackdetected blacklist add <hash>`	`/hkd blacklist add`	Add a mod hash to the blacklist
`/hackdetected blacklist remove <hash>`	`/hkd blacklist remove`	Remove a mod hash from the blacklist
`/hackdetected kick <player> [reason]`	`/hkd kick`	Kick a player with optional reason
`/hackdetected strikes <player>`	`/hkd strikes`	View a player's current strike count
`/hackdetected strikes <player> clear`	`/hkd strikes`	Reset a player's strikes
`/hackdetected reload`	`/hkd reload`	Reload configuration and all lists
`/hackdetected gui`	`/hkd gui`	Open the Admin Panel

Note: All commands require OP Level 2 or higher.

⚙️ Configuration

File: config/hackdetected-common.toml

The mod is highly customizable. You control exactly what gets detected, what action is taken, and how aggressive the mod should be.

#=== Detection Settings ===
[detection]
    # Keywords in mod filenames/metadata that flag mods (case-insensitive)
    blacklistKeywords = ["wurst", "meteor-client", "killaura", "xray", "aimbot", "forgehax", ...]

    # Known hack mod authors
    blacklistAuthors = ["wurstimperium", "alexander01998", "meteordevelopment", ...]

    # Suspicious class names to search inside JARs (CamelCase-aware matching)
    suspiciousClasses = ["KillAura", "Nuker", "SpeedHack", "Xray", "ChestESP", "AimBot", ...]

    # Suspicious Java package prefixes
    suspiciousPackages = ["net.wurstclient", "meteordevelopment.meteorclient", ...]

    # Named whitelist for client mods (partial match, case-insensitive)
    whitelistMods = ["sodium", "optifine", "journeymap", "jei", "jade", ...]

    # Enable deep JAR analysis (scans class files inside JARs)
    scanJarContent = true

    # Check loaded JVM classes for injected code
    checkLoadedClasses = true

    # Max JAR size to scan in MB (0 = unlimited)
    maxJarSizeMB = 50

    # Auto-whitelist all server mods (Level 1)
    autoWhitelistServerMods = true

    # Use SHA-256 hash database for instant L5 detection
    useHashDatabase = true

    # Re-check interval in minutes (0 = only on join)
    checkIntervalMinutes = 5

#=== Response Level Settings ===
[responseLevels]
    # Action for Level 4 (Unknown High Risk). Options: LOG, NOTIFY, KICK
    unknownHighRisk = "NOTIFY"

    # Action for Level 5 (Confirmed Threat). Options: LOG, NOTIFY, KICK
    confirmedThreat = "KICK"

#=== Action Settings ===
[actions]
    notifyAdmins = true
    autoKick = true
    autoBan = false              # WARNING: Use with caution!
    actionDelaySeconds = 5
    kickMessage = "Unauthorized mod detected. Remove it and reconnect."
    banMessage = "Banned for using hack mods. Appeal on the server's Discord."

#=== Strike System ===
[strikes]
    useStrikeSystem = true
    strikesBeforeKick = 2
    strikesBeforeBan = 3
    strikeResetHours = 168       # Reset after 1 week

#=== Logging ===
[logging]
    logToFile = true             # Logs saved to config/hackdetected/logs/
    logToConsole = true

📁 File Structure

The mod generates the following files in config/hackdetected/:

File	Description
`whitelist.json`	Manually approved mod hashes (Level 2). Managed via `/hkd whitelist` or the Admin Panel.
`blacklist_hashes.txt`	Known hack mod SHA-256 hashes (Level 5). One `hash=name` per line.
`blacklist_names.txt`	Blacklisted mod name patterns. Matched case-insensitively.
`logs/`	Detection logs with timestamps, player names, and mod details.

Example `blacklist_hashes.txt`:

# Known hack mod hashes
# Format: sha256hash=ModName.jar
7a875ad6f0f2ceda0bcabc54db01f02bc9e48c3ec2c843c22fce90fc6b59a0e8=MadXray-1.0.0-forge-1.20.1.jar

Example `whitelist.json`:

{
  "7980d4a0beed1dcd2c283cf65f3c93f6b0085833f3ac490014979c95f1dfaf67": "Bookshelf-Forge-1.20.1-20.2.15.jar"
}

⚠️ Important Notes

Server + Client required: Players must have the mod installed client-side for scanning to work. The server collects mod data; the client reports it.
False positives are rare thanks to CamelCase-aware class matching and configurable keyword lists. Any false positive can be whitelisted in one click from the Admin Panel.
Renaming won't help cheaters — SHA-256 hashes are based on file content, not filenames.
The Admin Panel provides full control — approve, block, scan, kick, and ban all from one screen.
Lightweight & async — scanning runs off the main thread with configurable size limits.