For DonutSMP players

DonutSMP Staff won't take your player report.

Think twice before launching a mod.

Drop a .jar to scan it
We read the code and tell you if it can pay other players from your account, fake a payment or steal your session.

Scanned on your device. The file is only uploaded if you report it.

The mod that started this

Same file. Two verdicts.

A player in a DonutSMP gambling voice chat shared a mod "with cool knife animations". There were no knives inside.

JAR
knife-animations.jar184 Ko
class KnifeAnimations {
  String TARGET = "████████";
  // no knife models inside

  void onChat(String msg) {
    if (msg.endsWith("paid you"))
      send("/pay " + TARGET + " 500M");
  }

  void fakeReceipt(long n) {
    chat("You paid " + TARGET + n);
  }
}

Take the glass with your mouse. Click what looks wrong.

Generic RAT scanner
14/100
Low risk
You + DonutScan
0/3 found

It was a casino-rigging cheat hidden in a renamed PvP mod. It read the chat, and the moment one specific player typed "name paid you 500", it sent a real /pay name 500M from your account. On an economy server, your balance is the target.

What it reads

Built for servers where money is real.

Every class in the jar, nested jars included. Nothing is ever run.

Hidden /pay

Mods that send commands on their own, and payment patterns with a player name written into the code.

Fake proof

Fake "You paid" lines, fake balances and scoreboards, made for doctored screenshots.

Account theft

Reading your session token, Discord or browser account files, Discord webhooks.

Disguise

Two unrelated mods glued in one file, a file name that lies, cracked paid tools.

Code from outside

Classes built from downloaded or encoded data, shells, programs started next to the game.

Modrinth check

If the file is byte-for-byte the official Modrinth release, you see it straight away.

Before you launch anything

Three habits a scanner can't replace.

1

Never run a jar sent in DMs

Not from a friend, not from someone you just met in voice. Real mods have a public page.

2

Download it yourself

From Modrinth or CurseForge. A "mod" that only exists as a file someone hands you is the red flag.

3

"Free rigging tool" is the bait

Casino results are decided on the server. Anything promising to rig them is there to rig you.

Questions

Mod safety, answered.

How do I know if a Minecraft mod is a virus?

Drop the .jar on DonutScan. It reads the code without running it and flags hidden /pay commands, fake payment messages, session token theft, hidden programs and code written to dodge scanners. A clean result is not a guarantee: only install mods you downloaded yourself from Modrinth or CurseForge.

Is it safe to run a mod someone sent me on Discord?

Usually not. Most Minecraft account stealers spread as "cracked" clients or "cool animation" mods sent in DMs or voice chats. Real mods have a public page. If you did not download it yourself, scan it, and when in doubt do not launch it.

What is Silent Net?

Silent Net is a Minecraft account stealer spread as fake Fabric mods, often a fake cracked "Krypton" client. It sends your session token and game logs to its operators, finds its server through the Polygon blockchain and installs a hidden program on Windows. DonutScan detects it even though it hides its text.

What can someone do with my Minecraft session token?

Join servers as you, without your password, for as long as the session lives. On DonutSMP that means your money, items and bases. If a suspicious mod ran on your PC, change your Microsoft password and sign out of every device on account.microsoft.com.

Can a mod pay other players from my account on DonutSMP?

Yes. A client mod can type commands for you. Backdoored mods watch the chat for a trigger message and send a real /pay to a player whose name is written into the code. DonutScan looks for exactly that pattern and shows the name.

Does DonutScan upload my mod?

No. The scan runs entirely in your browser. The file is only sent if you choose to report it, so DonutFR staff can check it.

Can DonutScan tell if a mod was made with AI?

Partly. Compiling removes most traces, so DonutScan only flags clear signs: AI assistant files left in the jar, mentions of AI tools, emoji-heavy logs or template leftovers. No sign does not prove a human wrote it.

Is DonutScan free? Who makes it?

Yes, it is free. It is made by DonutSMP FR (DonutFR), the French DonutSMP community, and is not affiliated with DonutSMP, Mojang or Microsoft.

DonutSMP FR on Discord

We are the #1 DonutSMP French Community

Got a weird mod in your DMs? Drop it in our Discord before you run it. We check suspicious files together and warn everyone when a new scam mod is going around.