To prevent you from wasting time here, this is per definition 100% not possible. I know this, as we found out the hard way for a client. All methods based around intercepting encryption packets and manually authenticating users cannot work. The reason is quite simple: premium clients will only start sending auth details required for identifying them once they are told to do so (encryption start packet clientbound, send automatically when in online mode) and when you tell a cracked client to do so (by manually sending this packet), they will be kicked immediately due to the nature of them not being able to authenticate. This is also stated by common login plugins, like FastLogin (can try find reference if required). What they do instead, is make users do a command/thing to tell the server they are premium. Only if they have done that command, will their plugin send the encryption start packets and intercept the response to detect premium. If a cracked player were to issue said command, that would auto kick them. But detecting whether or not users are premium without any manual step for the user is not possible per definition.