Cite observations in research

Prerequisites and plan required

Public aggregates, methodology and the small delayed 1-in-100 sample are available for initial research. Approved Researcher access is free and adds a bounded sample interface with higher limits. Professional or Enterprise is required for proprietary event rows; those plans do not automatically grant publication, redistribution or training rights.

Expected result: a reproducible citation that identifies the actual UTC observation window, retrieval date, data surface and limitations. Start with Research, Methodology and Data access. Preserve the distinction between what was observed and a claim about the wider internet.

1. Choose the right publication surface

Use published aggregates for counts and category trends. Read window and denominator fields alongside shares; an AI-related category does not necessarily mean hostile activity. For example, AI crawler, AI agent, Scanner and Exploit bot describe different observed behavior. Read the glossary before combining categories.

Use the public deterministic 1-in-100 sample for coarse individual examples. It is delayed at least 60 minutes, uses minute-level time and country-level origin, and is not a complete event stream. Sampling and withheld cells mean a visible subset should not be treated as a census of every actor or request. Withheld values are not zero.

2. Record provenance before analysis

Record the exact source page or endpoint, query parameters, UTC since/until window, retrieval date and any returned methodology version. Retain the original permitted data privately according to its license and your research policy. If you change categories, normalize fields or combine windows, describe those transformations alongside your results.

For API work, begin with the quickstart and API reference. Researcher samples permit at most 500 rows per call, a seven-day sample window and 2,000 sample rows per day, with at least 60 minutes of delay. Respect those bounds rather than attempting to reconstruct a full proprietary corpus from repeated requests.

3. Apply the correct rights

The public sample dataset is licensed CC BY 4.0. Attribute Mothlight, link the source and license, and identify changes when sharing material from that sample. Published aggregates and charts may be quoted or cited with attribution; they are not CC BY-licensed. Keep that distinction in figure captions and dataset manifests.

The full dataset, event-level data, realtime feeds and training exports are proprietary. An API key or paid subscription does not itself authorize redistribution or model training. Ask through Contact about licensing before publishing gated rows, sharing a derived corpus or training on proprietary data. Do not label a whole project CC BY merely because one input is the public sample.

4. Write a reproducible citation

Use a citation shaped like this, replacing the descriptive fields with the actual source and dates:

Place the citation beside the figure or table it supports. State the denominator for every percentage, including any checked subset. Record sensor uptime and withheld cells where supplied. Do not invent uptime estimates or substitute a plan's maximum history for the actual collection interval.

Troubleshooting and limitations

History is still filling since 2026-11-01; a short launch window is not a long-term baseline. Changes in coverage, uptime, classification or suppression can alter comparisons. A network operator is not necessarily an actor, an inferred AI label is not verified identity, and not seen means unknown, never safe. For an empty result, check dates and filters before interpreting it. For attribution or licensing uncertainty, contact the team with your intended use and the data surface, without including keys or private event rows. See FAQ for access errors and plan questions.