feat: update bph iocs

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson b/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson
new file mode 100644
index 0000000..5dde5d4
--- /dev/null
+++ b/kevlar/2026-08-17/censys/aggregations-AS51852.ndjson
@@ -0,0 +1,5 @@
+{"field":"host.services.port","buckets":[{"count":4348,"key":"443"},{"count":4040,"key":"22"},{"count":3413,"key":"161"},{"count":2727,"key":"80"},{"count":1879,"key":"123"},{"count":1551,"key":"53"},{"count":846,"key":"25"},{"count":827,"key":"500"},{"count":803,"key":"21"},{"count":798,"key":"143"},{"count":790,"key":"993"},{"count":789,"key":"110"},{"count":693,"key":"587"},{"count":658,"key":"1194"},{"count":627,"key":"8082"},{"count":574,"key":"111"},{"count":333,"key":"465"},{"count":327,"key":"995"},{"count":318,"key":"2096"},{"count":316,"key":"3306"},{"count":265,"key":"3333"},{"count":252,"key":"3389"},{"count":242,"key":"8443"},{"count":186,"key":"3128"},{"count":172,"key":"2083"}],"total_count":8542}
+{"field":"host.services.software.product","buckets":[{"count":4613,"key":"nginx"},{"count":3937,"key":"openssh"},{"count":2495,"key":"dovecot"},{"count":1322,"key":"exim"},{"count":835,"key":"openvpn_access_server"},{"count":802,"key":"cpanel"},{"count":739,"key":"bind"},{"count":595,"key":"ceph"},{"count":519,"key":"webmail"},{"count":368,"key":"php"},{"count":355,"key":"proftpd"},{"count":342,"key":"express"},{"count":325,"key":"virtual_environment"},{"count":324,"key":"pve"},{"count":275,"key":"fastpanel"},{"count":264,"key":"litespeed_web_server"},{"count":251,"key":"openresty"},{"count":237,"key":"wordpress"}],"total_count":8542}
+{"field":"host.labels.value","buckets":[{"count":8542,"key":"BULLETPROOF"},{"count":38,"key":"IPV6"}],"total_count":8542}
+{"field":"host.services.cert.parsed.issuer.common_name","buckets":[{"count":1823,"key":"server"},{"count":1474,"key":"YR2"},{"count":845,"key":"YR1"},{"count":828,"key":"Hydra Authentication RSA SubCA #154"},{"count":774,"key":"server.domain.com"},{"count":478,"key":"YE2"},{"count":381,"key":"YE1"},{"count":346,"key":"server.ibras.eu"},{"count":266,"key":"invalid2.invalid"},{"count":175,"key":"Hydra Authentication RSA SubCA #155"},{"count":157,"key":"Plesk"},{"count":152,"key":"Proxmox Virtual Environment"},{"count":130,"key":"Hydra Authentication RSA SubCA #156"},{"count":109,"key":"server.xtreme-results.net"},{"count":104,"key":"localhost"},{"count":72,"key":"(STAGING) Artificial Amaranth YE1"},{"count":66,"key":"(STAGING) Baloney Bulgur YE2"}],"total_count":8542}
+{"field":"host.operating_system.product","buckets":[{"count":3026,"key":"linux"},{"count":206,"key":"windows"},{"count":154,"key":"proxmox"},{"count":128,"key":"enterprise_linux"},{"count":34,"key":"ubuntu"},{"count":30,"key":"debian_linux"},{"count":26,"key":"freebsd"},{"count":25,"key":"centos"},{"count":25,"key":"routeros"},{"count":17,"key":"vmware_esxi_server"}],"total_count":8542}