Zealous Webworm 6

SCN-UNK-3F2F06 is an inferred behavioral cluster in the Mothlight observatory. A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise. This profile describes observed requests and classification evidence, not the intent of every visitor sharing a signature.

Questions, answered

Is confidence the same as AI likelihood?

No. Confidence measures support for the assigned label (out of 100). AI likelihood estimates evidence for AI involvement (out of 100). Identity verification is reported separately.

SCN · ScannerInferred clusterSCN-UNK-3F2F06

2026-11-03 18:56:31 UTC · Method & limitations ↗

Requests / 24 h: 24
Total requests: 32
Label confidence: 40% of 100
AI likelihood: 0% of 100

Confidence and AI likelihood are scores out of 100, not shares of traffic. Percentages elsewhere on this page state their denominator in the section text.

What this actor is

A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise.

Label: Scanner (SCN) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).

Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.

Evidence behind the label

Behaviour

32 observations (publishable events for this actor)

2026-11-02 15:36:31 UTC → 2026-11-03 18:56:31 UTC

User-agent claim

32 observations (publishable events for this actor)

2026-11-02 15:36:31 UTC → 2026-11-03 18:56:31 UTC

Client fingerprint

32 observations (publishable events for this actor)

2026-11-02 15:36:31 UTC → 2026-11-03 18:56:31 UTC

Evidence tier summary

verified: 0 publishable observations (identity supported by authoritative evidence)
claimed: 0 publishable observations (self-declared claim only, not verified)
inferred: 0 publishable observations (inferred from behaviour, not verified)
unknown: 32 publishable observations (tier could not be determined from available evidence)

What this actor does

Mostly GET requests to /about, /careers, /contact from 3 sources across 1 persona; 12 distinct paths observed; no exploitation attempts observed.

Based on 32 requests from 3 distinct sources. Buckets with fewer than 3 events or 2 sources are hidden. IPs are never listed here; user agents are shown only as product families. Percentages in breakdowns use the publishable buckets shown as their denominator.

Activity over time

Window adapts to available data since first seen; empty early periods are trimmed and labelled, not stretched across a 30-day axis.

2026-11-02Hourly requests, 48h2026-11-03

Data table: Hourly requests, 48h

Time	Requests
2026-11-02T13:00:00.000Z	0
2026-11-02T14:00:00.000Z	0
2026-11-02T15:00:00.000Z	8
2026-11-02T16:00:00.000Z	0
2026-11-02T17:00:00.000Z	0
2026-11-02T18:00:00.000Z	0
2026-11-02T19:00:00.000Z	0
2026-11-02T20:00:00.000Z	0
2026-11-02T21:00:00.000Z	0
2026-11-02T22:00:00.000Z	0
2026-11-02T23:00:00.000Z	0
2026-11-03T00:00:00.000Z	0
2026-11-03T01:00:00.000Z

Techniques, services and CVE observations

Services / traps targeted: site-page (32 of 32 publishable trap observations).

No publishable technique tags yet.

No publishable CVE observations yet. This does not mean the actor never probed a vulnerability; only that no bucket reached the publication threshold.

Robots, canary and honeytoken behaviour

Robots compliance: Not measured yet for this actor.

Canary follows: 0 publishable canary follows

Honeytoken uses: 0 publishable honeytoken uses

Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.

Related bots

No related bots above the similarity threshold.

No publishable related actors yet. Related actors are publishable bots sharing a known-bot identity, cluster label, or technique set; withheld single-source actors are not listed here.

Most requested paths

/about4
/careers4
/contact4
/status4

Event history

Professional

This actor's full event history

The per-actor observations with timestamps and request detail is part of the Professional plan, delivered through the API and dataset. The rows above are placeholders: this page contains no event data.

Upgrade to Professional →

Observation context

First seen: 2026-11-02 15:36:31 UTC
Last seen: 2026-11-03 18:56:31 UTC
Regions: iad1
Countries: US

How to cite

Copy this citation:

Mothlight Observatory. "Zealous Webworm 6" (SCN-UNK-3F2F06). First seen 2026-11-02, last seen 2026-11-03. https://mothlight.ai/bots/cl-3f2f06 (accessed 2026-11-03). Counts follow the publication rule (at least 3 events from at least 2 distinct sources).

Methodology and limitations

Zealous Webworm 6

Questions, answered

What this actor is

Evidence behind the label

Behaviour

User-agent claim

Client fingerprint

Evidence tier summary

What this actor does

Activity over time

Techniques, services and CVE observations

Robots, canary and honeytoken behaviour

Related bots

Most requested paths

Event history

This actor's full event history

Observation context

How to cite

Methods / protocols

Response status

Top paths

Personas (decoy sites)

Traps / services targeted

Sensor regions

Origin countries

ASN organisations

User-agent families

Time	Requests
2026-10-31T00:00:00.000Z	0
2026-11-01T00:00:00.000Z	0
2026-11-02T00:00:00.000Z	8
2026-11-03T00:00:00.000Z	24