Can Anticheats Detect Hacked Clients by Client Brand?

Can a client brand string identify a hacked client?

Not reliably. A client reports a brand value, and a modified client can send any value it likes. Brand strings are client-reported and trivially spoofable, so use them for triage, not as proof. Treat a brand alert as a reason to review, and never as the only reason to punish a player.

What a brand string can and cannot show

A brand value is a claim from the client. It can point to a mismatch worth a look, but it does not show what the client contains or does. Use the table to match each question with the evidence that can answer it.

Where the brand value comes from

Minecraft clients typically report a brand through a plugin message during connection. Whether your server version exposes that message, and whether a given anticheat reads it, depends on the server software and plugins you run. Confirm both before you build any rule on the value.

Mod loaders commonly report their own brand, so a modded player can look different from a vanilla player without any hack involved. A launcher or proxy can also change what reaches the server. Each of these is a legitimate reason for a mismatch, which is why the value is only a triage signal.

What to look for in logs and configuration

Record brand values only where your setup supports it, and only after you have a privacy basis for storing them. Keep the record next to the join time so staff can line it up with other evidence.

• The brand value for each join, and whether it changed between two sessions for the same player.
• Whether the value matches the modloader or launcher the player told staff they use.
• Check alerts that appear in the same session, and their timestamps.
• Whether the anticheat configuration has a brand-related setting, and what the documentation says it does.
• Retention settings for join logs, so brand values are not kept longer than your policy allows.

A numbered triage procedure for brand alerts

Use this order for every brand alert. Stop at any step where the evidence already answers the question.

• Write down the brand value, the join time, and the server version before you act.
• Check whether the value changed between sessions for this player.
• Ask the player what client, launcher, and mod loader they use, and record the answer.
• Compare the player's check alerts over several sessions, not a single join.
• Test the same client setup on staging with a test account, if the claim is specific enough to reproduce.
• Decide with at least one piece of evidence beyond the brand value, and record the reason.

Edge cases that change the result

A vanilla brand does not clear a player, because the client chooses the value it sends. A custom brand does not convict a player, because a legitimate mod loader or launcher can report one. Players on a shared network or a proxy may also show a value that does not match their device, so check the connection path before you read the value as personal behavior.

Brand data is personal data in many setups. Store it only for the purpose you can explain, and delete it on the schedule your retention policy sets.

Which triage result leads to which next step

The table shows the next step for common triage results. None of these results proves a hacked client on its own.

What we have not verified

We have not tested how any anticheat reads or scores the client brand. A modified client can change the value, so results on your server depend on how that client is built. Use brand data only for triage, and check each claim against your own staging setup before you rely on it.