🤖 Overview

WebScan is a legitimate security assessment crawler operated by Webscan (webscan.io), a company specializing in automated vulnerability scanning and continuous security monitoring for web applications. Its primary purpose is to systematically probe websites for common security weaknesses such as SQL injection, cross‑site scripting (XSS), insecure configurations, and outdated software versions, feeding the collected data into the Webscan dashboard for client reporting and remediation guidance.

🌐 Technical Behavior

WebScan performs crawl cycles that typically begin with a shallow reconnaissance phase, requesting robots.txt and sitemaps before proceeding to a depth‑first traversal of internal links. Scans are executed from a set of roughly 20–30 IPv4 addresses, predominantly within the ranges 104.28.x.x (Cloudflare proxy) and 185.220.x.x (Hetzner), with occasional requests originating from AWS EC2 instances. The bot sends requests at a rate of approximately 2–5 requests per second per target, with randomized delays of up to 2 seconds between requests to reduce server load. It supports both HTTP/1.1 and HTTP/2, and includes Accept: text/html,application/xhtml+xml and Accept-Language: en-US,en;q=0.5 headers. WebScan also parses JavaScript to extract AJAX endpoints and form actions, but does not execute complex client‑side logic.

📋 robots.txt Compliance

According to Webscan’s official documentation (webscan.io/faq/#robots), the bot fully respects robots.txt Disallow directives. It also obeys Crawl-Delay directives, though with a minimum enforced delay of 1 second. However, the bot will ignore Disallow rules for paths explicitly requested by the client as part of a targeted scan configuration, because security assessments require access to restricted areas; clients are expected to grant permission via the Webscan interface before such scans begin.

🔍 Detection Indicators

The primary User‑Agent string is WebScan (case‑sensitive, no version number). A secondary UA used for JavaScript‑based probing is Mozilla/5.0 (compatible; WebScan/1.0; +https://webscan.io/bot). Behavioral indicators include a high proportion of GET requests to .php, .asp, and .jsp resources, frequent requests for /?page= parameters, and the presence of an X-WebScan-Scanner: true custom header on approximately 10% of requests. Reverse DNS lookups on scanning IPs often resolve to scanner.webscan.io.

📊 Data Usage

Data collected by WebScan is used exclusively for the purpose of vulnerability assessment and security reporting for paying clients. Scan results – including identified vulnerabilities, page response codes, and SSL/TLS certificate details – are stored in encrypted form on Webscan’s AWS‑backed infrastructure and are retained for up to 90 days after the subscription ends. No data is used for AI training, search indexing, or any form of monetized analytics.

⚙️ Rate Limiting Policy

Because WebScan is a security scanner that can generate thousands of requests during a full assessment, it is subject to strict rate‑limiting (e.g., 10 requests per second per IP) to prevent performance degradation on target servers. Blocking thresholds are justified by the bot’s lack of human‑like pacing and the potential for unintentional denial‑of‑service if left unmanaged.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.