Mothlight's methodology is a passive, evidence-weighted approach to labeling automated web visitors. We separate observed behavior, vendor identity verification, label confidence, and AI likelihood so that researchers can inspect the uncertainty behind each claim.
Mothlight passively records automated requests arriving at public honeypot sensors. It distinguishes AI crawlers, user-delegated AI agents, scanners, and other bots.
No. Vendor identity verification and AI likelihood are separate measurements. Labels include confidence and evidence; AI-related traffic is not automatically hostile.
We record requests that automated visitors send to fictional systems. HTTP and TCP sensors measure different exposed surfaces. A region identifies a sensor location; it does not establish a visitor's physical location.
Confidence combines User-Agent evidence (up to 20), published IP ranges / rDNS / ASN (35), fingerprints (15), and behavior (30). A vendor string alone does not verify identity. Contradictory signals can reduce confidence.
We combine canary follows, semantic navigation, verified agent identity, framework indicators and request behavior. AIC means AI crawler; AIA means user-delegated AI agent; AIX means inferred AI-driven reconnaissance or exploitation. AIX requires AI likelihood of at least 60 and excludes verified vendor crawlers and agents.
Verified means a vendor identity agrees with published network evidence or rDNS. Spoofed means the claim conflicts with that evidence. Unverifiable means sufficient verification is unavailable. An inferred cluster groups requests without a vendor claim. None of these states alone establishes malicious intent.
Last-24-hour figures use a rolling window. Daily digests use UTC dates. Charts use the observation window supplied by the read model. Deduplication and sampling can affect high-volume traffic; observed counts are not estimates of all internet traffic.
A honeypot sees only actors that visit exposed sensors. Requests rejected by the edge network, unobserved protocols, missed heartbeats and classification delays affect the result. A shared signature does not prove a shared person or organization.
Include the UTC observation window, access date, bot ID, confidence and verification state. Preserve the distinction between measured behavior and inferred AI use.
Data access & attribution →