A server system generates and transfers Precision Time Protocol (PTP) synch requests for delivery to a PTP clock server and responsively receives PTP synch responses transferred by the PTP clock server. The server system processes the PTP synch responses to determine PTP clock phase error data for the PTP clock server. The server system compares the PTP clock phase error data to a historical phase error threshold for the PTP clock server. If the PTP clock phase error data does not exceed the historical phase error threshold, then the server system updates the historical phase error threshold for the PTP clock server based on the PTP clock phase error data. If the PTP clock phase error data exceeds the historical phase error threshold, then the server system generates an indication that the PTP clock server comprises a malicious PTP node.