🤖 Overview

Hiscan is a legitimate web security crawler operated by HisScan Inc., a cybersecurity firm focused on automated vulnerability detection. First documented around 2018, the bot’s purpose is to systematically probe public-facing web applications for common security flaws such as cross-site scripting (XSS), SQL injection, and misconfigured headers, feeding results into the company’s HisScan Security Platform used by enterprises to assess their external attack surface. Official documentation at hiscan.com states the service is intended for authorized scanning only, and operators must verify ownership before initiating scans.

🌐 Technical Behavior

The crawler performs depth-first traversal of discovered links, typically starting from a provided seed URL, and sends requests at a rate of approximately 10–15 requests per second per target. Hiscan uses both HTTP and HTTPS, and issues a mix of GET and POST requests during form testing. IP addresses originate from a block registered to HisScan’s AWS infrastructure, primarily in the 3.64.0.0/12 range, though specific subnets vary by region. The crawler follows redirects, parses JavaScript-driven content to a limited extent, and respects the Cache-Control header to avoid overloading cached resources. According to a 2022 blog post by HisScan, the bot employs exponential backoff when it receives 429 Too Many Requests responses.

📋 robots.txt Compliance

Hiscan publicly commits to honoring robots.txt directives, as confirmed in its official documentation at hiscan.com/robots. Testing by independent researchers in 2023 showed the bot correctly reads and applies Disallow rules, pausing or skipping paths after the directive is encountered. However, it does not cache robots.txt across scans, re‑fetching it at the start of each new session.

🔍 Detection Indicators

The most reliable User‑Agent string is Hiscan/1.0 (and variants like Hiscan/2.0), often accompanied by the HTTP header X-Scanner: Hiscan. The bot also sets Accept: */* and Connection: keep-alive. Behavioral fingerprints include a consistent request interval, a high proportion of requests to /admin, /login, and /api endpoints, and the inclusion of a custom User-Agent that cannot be spoofed without breaking the scanner’s operation.

📊 Data Usage

Collected data—such as HTTP response codes, parameter values, and page diffs—is used exclusively to generate vulnerability reports for the platform’s subscribers. No raw content is stored beyond the scan window; instead, findings are aggregated into a dashboard that highlights severity, remediation steps, and affected URLs. HisScan’s privacy policy confirms that scanned data is not used for AI training or resale.

⚙️ Rate Limiting Policy

Hiscan is rate‑limited because its scanning methodology can inadvertently trigger rate thresholds or degrade performance on smaller websites. A threshold-based blocking policy (e.g., 200 requests per minute per IP) is recommended to balance the scanner’s thoroughness with server stability, as documented in HisScan’s own operational guidelines.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.