Mothlight is an open observatory of bots and AI agents on the web. It is a research project built and operated by SEWORKS, an offensive security company founded in San Francisco in 2013.
Mothlight runs a network of passive sensors and fictional systems, often called honeypots. When automated visitors arrive, we record what they request, label the visitor, score label confidence and AI likelihood, and publish aggregates, bounded lists and delayed samples so others can study the same evidence. No sensor imitates a real company or product, and a label is a measurement with uncertainty, not a verdict on intent.
SEWORKS describes its work as seeing software the way an attacker does. The company was founded in San Francisco in 2013 by white-hat hackers, and its background is offensive security: finding weaknesses from an attacker's perspective before they are used against a real system. SEWORKS is the legal and operational home of Mothlight. It designs the sensors, runs the infrastructure, maintains the labeling method and is responsible for what this site publishes.
Outside Mothlight, SEWORKS builds Pentoma for AI penetration testing, LeakJar for breached-password defense, and AppSolid for mobile app hardening. Mothlight is separate from those products: it is a public research project, not a customer system, and it holds no customer data.
Defensive work depends on knowing what attackers and automated agents actually do, not what they are assumed to do. Mothlight gives SEWORKS, and anyone who reads this site, a shared, inspectable record of that behavior: which paths are probed, which identities are claimed or spoofed, and how automated traffic changes over time. Publishing the observations, with their limits stated, is the point of the project.
Questions, corrections and removal requests are welcome. Email help@mothlight.ai or use the contact page. For a removal request, include the relevant IP address or bot ID and the UTC observation window, and never send real passwords or API keys.