In one embodiment, a cloned cable modem detector is configured to assemble a table associating cable modem physical addresses to Cable Modem Termination Systems (CMTSs) according to provisioning requests forwarded from the CMTSs. When one of the provisioning requests associates a cable modem physical address with a different CMTS than an existing association in the table, the detector outputs an indication of cable modem cloning.