Ok. Again, I'll try to get this explanation right, so all of you great script helpers out there, can help me with this one.

I have this script, which does work just fine for clone-detection, then kicking:
Code:
 on @*:JOIN:#:{
  if ($ial == $false) .ial on
  if ($chan(#).ial == $false) { who # | return }
  var %total = $ialchan($wildsite,#,0)
  if (%total > 1) {
    ban -u60 # $nick 2
    var %i = 0
    while (%i < %total) {
      inc %i
      var %nick = $ialchan($wildsite,#,%i).nick     
      var %all.nicks = $addtok(%all.nicks,%nick,32)    
      if (%nick !isop #) {
        kick # %nick Clone flood detected from $wildsite ( $+ %total users)
      }
    }
    echo 14 -a Clone flood detected from $wildsite $+ : %all.nicks
  }
}


What I'm trying to do, is use a basic code much like the above, yet instead of kicking a single clone(s) when the clonee joins, instead what I want to do, is wait or cache or whatever, the kicking/banning until approx. 6 clones or more have joined in a given timeframe, for example 20-30 secs. If that should happen, then kick/ban the offending 6 clones. It doesnt have to be both offenders of the cloneset, like that script will do, even just the joiner that creates a cloneset will work for me. The problem area for me to figure out, is how to go back to k/b those cached clonesets. I don't want to take action on just the 1 or 2 occaisional clones, but more so, the beginning of a serious problem, which 1 or 2 is not. See what I mean?

To try to answer the question about how they would be clone-detected, it will not be by nick at all, but by hostmask, so it looks like the third one you listed would be the choice for me.

I hope this is finally clear enough to someone, so that they can help me slowly fill in the blanks here. Thanks.