⚠️ Overview

Hardenize is a commercial web security scanning service launched in 2016 by security researcher and entrepreneur Scott Helme, now operated by Hardenize Ltd. (UK). It is publicly accessible at hardenize.com and performs automated security assessments of web applications, focusing on TLS, HTTP security headers, email security, and DNS configuration. The tool is used legitimately by website owners and security teams, but is classified as a malicious bot by many organisations due to its aggressive, unauthenticated scanning behaviour and potential for reconnaissance.

🔧 Technical Capabilities

Hardenize conducts deep scans of over 100 security checks including TLS version detection, cipher suite analysis, certificate chain validation, HSTS implementation, Content Security Policy (CSP) evaluation, and X-Frame-Options headers. It also checks for CVE vulnerabilities such as Heartbleed (CVE-2014-0160), POODLE (CVE-2014-3566), and ROBOT (CVE-2017-17382) by probing servers with crafted requests. The scanner performs DNS record analysis, detecting SPF, DKIM, and DMARC misconfigurations, as well as exposed subdomains and open ports. It operates by sending multiple HTTP/HTTPS requests in quick succession, often from a pool of dedicated IP addresses assigned to Hardenize, and supports scanning of both IPv4 and IPv6 services. The tool does not perform exploitation but can identify misconfigurations that lead to data exposure or man-in-the-middle attacks.

📜 History & Notable Incidents

Hardenize was originally introduced as a free service to complement Scott Helme’s popular securityheaders.com and report-uri.com platforms. In 2018, it gained attention when it was used to scan thousands of sites for CVE-2018-0886 (Credential Guard vulnerability) and later for CVE-2020-0601 (CurveBall). No major breaches have been attributed directly to Hardenize, but administrators have reported false-positive alerts from SIEM systems due to its scanning traffic. The tool’s default behaviour of scanning the top 1 million websites automatically has led to it being listed on many blocklists for unauthorised reconnaissance.

🔍 Detection Indicators

The primary detection indicator is the User-Agent string “Hardenize/1.0” (often appended with “(+https://hardenize.com)”). Other fingerprints include non-standard request patterns such as simultaneous probes for HTTPS on port 443 and HTTP on port 80, along with TLS handshake anomalies like support for outdated cipher suites used only for testing. The scanner typically originates from IP addresses listed in the Hardenize IP range (e.g., 104.27.x.x and 172.64.x.x), which change periodically. Behavioural patterns include repeated HEAD requests to /, /.well-known/security.txt, and common admin paths.

☠️ Risk & Impact

While Hardenize does not launch direct attacks, its comprehensive scanning can reveal sensitive configuration details, such as exposed API keys in error pages, weak TLS ciphers, or missing security headers. This information could be leveraged by malicious actors for targeted exploitation. Additionally, the volume of requests may cause resource exhaustion on under‑provisioned servers and trigger unnecessary incident response alerts, leading to operational overhead and potential denial of service for legitimate users.

🛡️ Mitigation

Hardenize is blocked immediately on detection because it represents unauthorised reconnaissance that violates the security policy of many web applications. Mitigation includes adding the User-Agent string to WAF rules, blocking the known IP ranges, and configuring automated rate limiting to drop requests from any IP that exhibits scanner‑like behaviour without prior authorisation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.