First Documentation of BarkScan_1.0: A New Internet Scanner with an Identity Problem
On March 26, 2026, my Cowrie SSH honeypot logged an SSH client version string I’d never seen before and couldn’t find documented anywhere: SSH-2.0-BarkScan_1.0. What followed was a few hours of investigation that surfaced a new commercial internet scanner with a legitimate-looking website, an anonymous team, and a globally-flagged malicious IP – and no clean answer on which description was more accurate. This appears to be the first public documentation of the BarkScan_1.0 banner string. GreyNoise subsequently reviewed the IP and escalated it internally as high priority. ...