Behaviour
4 observations (publishable events for this actor)
2026-11-01 09:16:58 UTC → 2026-11-02 02:56:11 UTC
LIB-UNK-3392C5 is an inferred behavioral cluster in the Mothlight observatory. Traffic from an HTTP library or script, with no stronger identity claim. This profile describes observed requests and classification evidence, not the intent of every visitor sharing a signature.
No. Confidence measures support for the assigned label (out of 100). AI likelihood estimates evidence for AI involvement (out of 100). Identity verification is reported separately.
LIB-UNK-3392C5Confidence and AI likelihood are scores out of 100, not shares of traffic. Percentages elsewhere on this page state their denominator in the section text.
Traffic from an HTTP library or script, with no stronger identity claim.
Label: LIB · Inferred cluster (grouped by shared client signature; not a proven person or organisation).
Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.
4 observations (publishable events for this actor)
2026-11-01 09:16:58 UTC → 2026-11-02 02:56:11 UTC
4 observations (publishable events for this actor)
2026-11-01 09:16:58 UTC → 2026-11-02 02:56:11 UTC
4 observations (publishable events for this actor)
2026-11-01 09:16:58 UTC → 2026-11-02 02:56:11 UTC
Mostly HEAD requests to / from 2 sources across 1 persona; 1 distinct paths observed; no exploitation attempts observed.
Based on 4 requests from 2 distinct sources. Buckets with fewer than 3 events or 2 sources are hidden. IPs are never listed here; user agents are shown only as product families. Percentages in breakdowns use the publishable buckets shown as their denominator.
Window adapts to available data since first seen; empty early periods are trimmed and labelled, not stretched across a 30-day axis.
| Time | Requests |
|---|---|
| 2026-11-01T07:00:00.000Z | 0 |
| 2026-11-01T08:00:00.000Z | 0 |
| 2026-11-01T09:00:00.000Z | 2 |
| 2026-11-01T10:00:00.000Z | 0 |
| 2026-11-01T11:00:00.000Z | 0 |
| 2026-11-01T12:00:00.000Z | 0 |
| 2026-11-01T13:00:00.000Z | 0 |
| 2026-11-01T14:00:00.000Z | 0 |
Not enough data yet. Technique, service and CVE breakdowns appear when a bucket reaches at least 3 events from at least 2 distinct sources.
Robots compliance: Not measured yet for this actor.
Canary follows: 0 publishable canary follows
Honeytoken uses: 0 publishable honeytoken uses
Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.
/4First seen: 2026-11-01 09:16:58 UTC
Last seen: 2026-11-02 02:56:11 UTC
Regions: icn1
Countries: KR
Copy this citation:
Mothlight Observatory. "Amber Dobsonfly" (LIB-UNK-3392C5). First seen 2026-11-01, last seen 2026-11-02. https://mothlight.ai/bots/cl-3392c5 (accessed 2026-11-02). Counts follow the publication rule (at least 3 events from at least 2 distinct sources).
| 2026-11-01T15:00:00.000Z | 0 |
| 2026-11-01T16:00:00.000Z | 0 |
| 2026-11-01T17:00:00.000Z | 0 |
| 2026-11-01T18:00:00.000Z | 0 |
| 2026-11-01T19:00:00.000Z | 0 |
| 2026-11-01T20:00:00.000Z | 0 |
| 2026-11-01T21:00:00.000Z | 0 |
| 2026-11-01T22:00:00.000Z | 0 |
| 2026-11-01T23:00:00.000Z | 0 |
| 2026-11-02T00:00:00.000Z | 0 |
| 2026-11-02T01:00:00.000Z | 1 |
| 2026-11-02T02:00:00.000Z | 1 |
| 2026-11-02T03:00:00.000Z | 0 |
| 2026-11-02T04:00:00.000Z | 0 |
| 2026-11-02T05:00:00.000Z | 0 |
| 2026-11-02T06:00:00.000Z | 0 |
| Time | Requests |
|---|---|
| 2026-10-30T00:00:00.000Z | 0 |
| 2026-10-31T00:00:00.000Z | 0 |
| 2026-11-01T00:00:00.000Z | 2 |
| 2026-11-02T00:00:00.000Z | 2 |