How disk-snapshot cloning is caught.
The heartbeat logs {license_id, hardware_id, public_ip, timestamp}. If one hardware_id beats from two or more public IPs inside the clone window (~10 min), the disk was snapshot-cloned — a legit migration moves one IP at a time — so the license is suspended and an alert is raised.