Nodes sharing an identical public key — a definitive indicator of device cloning, firmware key reuse, or mesh misconfiguration. Each group represents nodes that are cryptographically indistinguishable. Hardware and MAC divergence within a group indicates physical cloning. Scans run every 24 hours automatically.

Nodes actively broadcasting a key that conflicts with their baselined identity. The RF Anomaly Engine evaluates the incoming signal against the mathematical average to flag physical cloning attempts.