Identifying and blacklisting a "hack" mod on connection

[Matryoshika]

Preface: I will not name the mod I'm trying to identify on client-connection, bar possibly in PM to someone from the Forum Team. It shouldn't be known about

I'm part of a server-network that has started to see several players using a "hacking mod" that allows them to manipulate packets.
The mod in question goes cross-language between java and C++.

Usually, for things like this, we just add the offending mod's modid to a blacklist plugin and that'll disallow the client from connecting to any of our servers.
However, this mod in question, stupidly enough, allows the user to edit it's own modid, modname and version-id through a gui in the menu, to anything they user can think of.
This is quite disconcerting.

I know there's very little information given here, but is there anything bar modid/modname/version given out in any packet/handshake/event that can be used to identify a mod?
 

[Draco18s]

No. The client (ie the cheat mod in question) could simply not report itself entirely.

[DavidM]

I don't think there would a way to detect the mod, even with a mod whitelist.

 

  On 8/3/2019 at 8:11 PM, Matryoshika said:

players using a "hacking mod" that allows them to manipulate packets

Expand  

What kind of packets do they manipulate, and in what way? Is it possible to detect such packet change?

[Matryoshika]

Pretty much every packet, Vanilla, Forge and quite the select few modded ones, like EIO teleportation, are fired from the client with modified data.
Spawning in items mainly by using the CPacketCreativeInventoryAction although the mechanics for how the server is accepting it from the client is beyond me.