This host (65.108.47.36, recon.withhendrik.com) sends a small
number of HTTP GET requests to hosts that are in scope of bug-bounty and vulnerability-disclosure
programmes.
It is monitoring, not scanning: no port scans, no fuzzing, no payloads, no
authentication, no brute force. It reads public pages and JavaScript bundles, and probes a handful of
documented paths (such as /robots.txt and /.well-known/security.txt) to
notice that a target's surface has changed.
| Rate | at most a few requests per minute per host; at most 6 per host per day in steady state |
| Identity | User-Agent: Mozilla/5.0 (compatible; recon-watch/2.0; bug-bounty
monitoring; X-Bug-Bounty: HackerOne-whp-wessel) |
| Stop on request | immediately and permanently for your domain — email us and it is done within 24 hours |
Email security@withhendrik.com with the hostname or the log lines. We will add it to the exclusion list, and you will not see another request from this address. You do not need to file an abuse report with the hosting provider.
Wessel, a security researcher on HackerOne as whp-wessel. Requests are only sent to hosts that a program lists as in scope at the time of the request; the scope used for each request is recorded and can be quoted back on request.
Contact: security@withhendrik.com · security.txt