Mothlight is a defensive research observatory that passively records inbound traffic to fictional systems. Our publication policy balances reproducible evidence with conditional IP disclosure, sensitive-data redaction, limited retention and a contact process for corrections or removal.
No. Sensors only respond to inbound connections. They do not execute uploaded code, fetch visitor-supplied URLs, or call attacker infrastructure.
We passively observe inbound requests. We do not actively scan, retaliate, or contact visitor infrastructure. Decoys use fictional brands and never imitate real companies or products.
For research, sensors record request times, protocols, paths, headers, IP addresses, ASN / geographic information, client signatures and bounded request-body samples. Captured credentials, prompts and payload samples can contain sensitive information.
Known vendor crawler categories (AIC, AIA, SEC, MON) and automated / malicious categories (SCN, EXP, AIX, LIB, HBR, UNK) with confidence at least 70 are eligible for raw IP publication. Other observations, including HUM, publish IPv4 /24 or IPv6 /48 masked addresses and ASN information.
Public prompt, credential and payload samples are subject to automatic redaction and a 24-hour delay. Raw events are retained for 180 days; captured payload samples for 90 days; aggregates indefinitely. Active honeytoken and canary values are not published.
Fake LLM and MCP endpoints return static or templated responses without calling real models or tools. URL parameters are recorded, never fetched. Uploads are hashed and sampled inertly up to 16 KiB; they are never served back or executed.
Email the address below with the relevant IP or bot ID, UTC observation window, and reason for the request. We review ownership, scope and retention needs, then communicate the outcome. Do not include real passwords or API keys in your email.