1. A method comprising: applying a heuristic to an online modem connected to an internet service provider (ISP) to determine a likelihood that the online modem is hacked such that the online modem is circumventing legitimacy mechanisms of the ISP to receive internet services without authorization from the ISP, wherein applying the heuristic comprises: performing one or more tests on the online modem, wherein results of the one or more tests are indicative of the likelihood that the online modem is hacked; determining a score based on the results of the one or more tests, and determining whether the score is greater than or equal to a threshold wherein the score is correlated to the likelihood that the online modem is hacked; searching the results of the one or more tests to identify one or more combinations of results from the one or more tests, wherein identification of the one or more combinations is indicative of an increased likelihood that the online modem is hacked; applying a classification to the online modem based on one or both of the determined score being greater than or equal to the threshold and the identified combinations of test results; and applying a rule to the online modem based on the applied classification.