WATCH
Inventory & tells
If it is not on this list, it is not yours. Five classic compromise signs — plus pairing and Accessibility, because that is how RedHook and WhisperPair show.
Compromise signs
ClearNetwork is slower than usual for no clear reason
Unknown devices show up in the router client list
DNS, firewall, or port-forwarding settings changed
Accounts locked out — credentials may have been stolen
Router is warm or busy when nobody is home
Unexpected Bluetooth pairing prompts or new ADB pairings
An app you do not trust has Accessibility permission
Devices
0 listedDetection tools
Fing
Scans the LAN and lists connected devices, manufacturers, and addresses. Use it to build the inventory on Watch.
WiFiDeath
Watches deauthentication frames and flags protection gaps. Useful when the network keeps dropping in public.
WIDS / WIPS
Wireless intrusion detection and prevention — the enterprise version of ‘someone stood up an evil twin on floor three.’