Unpacking the BADBOX Botnet with Censys

Executive Summary: BADBOX is a recently identified botnet infecting primarily Android devices — often appearing pre-installed in firmware or introduced through the supply chain — with over 190,000 compromised devices observed, including higher-end smart TVs. Analysis using Censys identified a single suspicious self-signed certificate (issuer DN and SHA-256 fingerprint) and a reused SSH host key presented across multiple Singapore-based IPs and numerous domains, indicating templated instances controlled by a common actor; the report includes IPs, domains, certificate and SSH fingerprints as IOCs for tracking and mitigation.