Onyx Thrip 2

SCN-UNK-DF5AAC is an inferred behavioral cluster in the Mothlight observatory. A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise. This profile describes observed requests and classification evidence, not the intent of every visitor sharing a signature.

Questions, answered

Is confidence the same as AI likelihood?

No. Confidence measures support for the assigned label (out of 100). AI likelihood estimates evidence for AI involvement (out of 100). Identity verification is reported separately.

SCN · ScannerInferred clusterSCN-UNK-DF5AAC

2026-11-05 06:26:32 UTC · Method & limitations ↗

Withheld · single source. All observed requests for this actor came from one distinct source, so exact counts are withheld under the publication rule (at least 3 events from at least 2 distinct sources). Approximate volume: Fewer than 3 requests. This actor is still listed so the observation is citable, but it is not ranked by volume. How the publication rule works

Requests / 24 h: 0
Total requests: Withheld · single source
Label support: 15/100 evidence strength
AI involvement support: 0/100 evidence strength

Evidence strength is a heuristic score out of 100, not a probability. Percentages elsewhere on this page state their denominator in the section text.

What this actor is

A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise.

Label: Scanner (SCN) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).

Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.

Evidence behind the label

Behaviour

Withheld · single source — count not published for this signal.

2026-11-05 06:26:29 UTC → 2026-11-05 06:26:32 UTC

Evidence tier summary

verified: Not enough data yet (identity supported by authoritative evidence)
claimed: Not enough data yet (self-declared claim only, not verified)
inferred: Not enough data yet (inferred from behaviour, not verified)
unknown: Withheld · single source (tier could not be determined from available evidence)

What this actor does

Counts for this actor are withheld because all observed requests came from a single source. Behavioural breakdowns are not published until the actor is seen from at least two distinct sources with at least three events.

Volume band: Fewer than 3 requests. Exact counts, paths, and breakdowns stay unpublished for single-source actors. How the publication rule works

Techniques, services and CVE observations

Withheld · single source. Technique, service and CVE breakdowns are not published for single-source actors.

Robots, canary and honeytoken behaviour

Robots compliance: Withheld · single source — not measured for publication.

Canary follows: Withheld or below publication threshold — not a zero. Canary follows are counted only when publishable.

Honeytoken uses: Withheld or below publication threshold — not a zero.

Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.

Related bots

Most requested paths

Withheld · single source. Paths are not published for single-source actors.

Event history

Professional

This actor's full event history

The per-actor observations with timestamps and request detail is part of the Professional plan, delivered through the API and dataset. The blurred rows in this panel are a visual skeleton, not observations.

Observation context

First seen: 2026-11-05 06:26:29 UTC
Last seen: 2026-11-05 06:26:32 UTC
Regions: Not published yet
Countries: Not published yet

How to cite

Copy this citation:

Mothlight Observatory. "Onyx Thrip 2" (SCN-UNK-DF5AAC). First seen 2026-11-05, last seen 2026-11-05. https://mothlight.ai/bots/cl-df5aac (accessed 2026-11-08). Counts follow the publication rule (at least 3 events from at least 2 distinct sources).

Methodology and limitations