Hunting Botnets With CursorAI, GreyNoise, Censys, and Censeye

Censys Research describes a tool-driven investigation that combines Censys, GreyNoise, Censeye, and CursorAI to find potential ORB/proxy networks and a probable IoT botnet fingerprint: a widespread BusyBox telnet banner (frequently on TCP port 45634) observed across many devices. The team found ~750 BusyBox hosts flagged by GreyNoise as botnet- or exploitation-related and roughly 1,139 hosts matching the BusyBox/banner+port patterns, highlighting likely active compromise of routers and embedded devices and sharing queries and tools to detect these indicators.