The labels used across Mothlight, defined once. Where a page uses a shorter label, this page governs its meaning.
AIC = AI crawler; AIA = user-delegated AI agent; AIX = inferred AI-driven recon or exploitation; SCN = scanner; EXP = exploit bot; HBR = headless browser; LIB = HTTP library; SEC = search crawler; MON = monitor; HUM = likely human; UNK = unknown. A category describes observed behaviour, not intent.
Verified = identity supported by published network ranges or cryptographic verification. Claimed = self-declared only (e.g. a vendor name in a User-Agent — shown as a claimed identity unless verified). Inferred = behavioural evidence without a verified identity. Suspected = weak or partial signals, not yet a firm label. Spoofed = the claimed identity is contradicted by network or other evidence; for AI claims, only contradicted AI identities count as spoofed AI claims.
Observed request intent only: discovery, probe, exploit attempt, credential access attempt, post-exploit signal. An exploit attempt is not a compromise.
Withheld means a cell did not meet the publication rule (at least 3 events and 2 distinct sources) or is single-source; it is never shown as 0. Zero means an observed zero in the stated window.
The public 1-in-100 sampled observations: a deterministic 1% sample published for inspection. It is a sample, not the full record, and carries the same delays and masking.
Home-page and map aggregates are rolling windows refreshed about every 2 minutes (map aggregates delayed at least 15 minutes). Event-level samples are delayed at least 60 minutes. Professional event-level access is delayed at least 15 minutes; Enterprise is real-time under custom terms.
Separate 0–100 measures. Confidence weights User-Agent (20), network identity (35), fingerprint (15) and behaviour (30). AI likelihood combines canary follows, semantic navigation, verified agent identity, framework indicators and behaviour. Neither is a verdict on a person or organisation.