SCN-UNK-53B02E is an inferred behavioral cluster in the Mothlight observatory. A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise. This profile describes observed requests and classification evidence, not the intent of every visitor sharing a signature.
Questions, answered
Is confidence the same as AI likelihood?+
No. Confidence measures support for the assigned label (out of 100). AI likelihood estimates evidence for AI involvement (out of 100). Identity verification is reported separately.
Evidence strength is a heuristic score out of 100, not a probability. Percentages elsewhere on this page state their denominator in the section text.
What this actor is
A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise.
Label: Scanner (SCN) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).
Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.
Evidence behind the label
Behaviour
4 observations (publishable events for this actor)
2026-11-02 14:21:46 UTC → 2026-11-03 18:21:40 UTC
User-agent claim
4 observations (publishable events for this actor)
2026-11-02 14:21:46 UTC → 2026-11-03 18:21:40 UTC
Client fingerprint
4 observations (publishable events for this actor)
2026-11-02 14:21:46 UTC → 2026-11-03 18:21:40 UTC
Evidence tier summary
verified: 0 publishable observations (identity supported by authoritative evidence)
claimed: 0 publishable observations (self-declared claim only, not verified)
inferred: 0 publishable observations (inferred from behaviour, not verified)
unknown: 4 publishable observations (tier could not be determined from available evidence)
What this actor does
Requests only `/` with GET from 4 sources; no exploitation attempts observed in the published technique evidence; consistent with uptime or metrics scraping.
Based on 4 requests from 4 distinct sources. Buckets with fewer than 3 events or 2 sources are hidden. IPs are never listed here; user agents are shown only as product families. Percentages in breakdowns use the publishable buckets shown as their denominator.
Activity over time
Window adapts to available data since first seen; empty early periods are trimmed and labelled, not stretched across a 30-day axis.
The per-actor observations with timestamps and request detail is part of the Professional plan, delivered through the API and dataset. The blurred rows in this panel are a visual skeleton, not observations.
First seen: 2026-11-02 14:21:46 UTC Last seen: 2026-11-03 18:21:40 UTC Regions: pdx1 Countries: US
How to cite
Copy this citation:
Mothlight Observatory. "Saffron Harvester 5" (SCN-UNK-53B02E). First seen 2026-11-02, last seen 2026-11-03. https://mothlight.ai/bots/cl-53b02e (accessed 2026-11-04). Counts follow the publication rule (at least 3 events from at least 2 distinct sources).