SCN-UNK-9A486F is an inferred behavioral cluster in the Mothlight observatory. A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise. This profile describes observed requests and classification evidence, not the intent of every visitor sharing a signature.
Questions, answered
Is confidence the same as AI likelihood?+
No. Confidence measures support for the assigned label (out of 100). AI likelihood estimates evidence for AI involvement (out of 100). Identity verification is reported separately.
Confidence and AI likelihood are scores out of 100, not shares of traffic. Percentages elsewhere on this page state their denominator in the section text.
What this actor is
A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise.
Label: Scanner (SCN) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).
Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.
Evidence behind the label
Behaviour
5 observations (publishable events for this actor)
2026-11-03 01:51:21 UTC → 2026-11-04 10:04:35 UTC
User-agent claim
5 observations (publishable events for this actor)
2026-11-03 01:51:21 UTC → 2026-11-04 10:04:35 UTC
Client fingerprint
5 observations (publishable events for this actor)
2026-11-03 01:51:21 UTC → 2026-11-04 10:04:35 UTC
Evidence tier summary
verified: 0 publishable observations (identity supported by authoritative evidence)
claimed: 0 publishable observations (self-declared claim only, not verified)
inferred: 0 publishable observations (inferred from behaviour, not verified)
unknown: 5 publishable observations (tier could not be determined from available evidence)
What this actor does
Requests only `/` with GET from 3 sources; no exploitation attempts; consistent with uptime or metrics scraping.
Based on 5 requests from 3 distinct sources. Buckets with fewer than 3 events or 2 sources are hidden. IPs are never listed here; user agents are shown only as product families. Percentages in breakdowns use the publishable buckets shown as their denominator.
Activity over time
Window adapts to available data since first seen; empty early periods are trimmed and labelled, not stretched across a 30-day axis.
The per-actor observations with timestamps and request detail is part of the Professional plan, delivered through the API and dataset. The rows above are placeholders: this page contains no event data.
First seen: 2026-11-03 01:51:21 UTC Last seen: 2026-11-04 10:04:35 UTC Regions: iad Countries: US
How to cite
Copy this citation:
Mothlight Observatory. "Onyx Webworm 7" (SCN-UNK-9A486F). First seen 2026-11-03, last seen 2026-11-04. https://mothlight.ai/bots/cl-9a486f (accessed 2026-11-04). Counts follow the publication rule (at least 3 events from at least 2 distinct sources).