add: bph report iocs and daily drop helper

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson b/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson
new file mode 100644
index 0000000..2b0bdd8
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 15031, "key": "22"}, {"count": 8402, "key": "443"}, {"count": 7549, "key": "3389"}, {"count": 7374, "key": "80"}, {"count": 1112, "key": "2096"}, {"count": 985, "key": "135"}, {"count": 930, "key": "5985"}, {"count": 864, "key": "8443"}, {"count": 853, "key": "445"}, {"count": 808, "key": "53"}, {"count": 656, "key": "25"}, {"count": 641, "key": "139"}, {"count": 610, "key": "8080"}, {"count": 577, "key": "21"}, {"count": 534, "key": "111"}], "total_count": 25147}
+{"field": "host.services.software.product", "buckets": [{"count": 14145, "key": "openssh"}, {"count": 9964, "key": "nginx"}, {"count": 2488, "key": "express"}, {"count": 1561, "key": "http_server"}, {"count": 1230, "key": "dovecot"}, {"count": 1104, "key": "http_api"}, {"count": 855, "key": "google_web_services"}, {"count": 814, "key": "web_server"}, {"count": 708, "key": "caddy"}, {"count": 666, "key": "jquery"}, {"count": 600, "key": "internet_information_services"}, {"count": 561, "key": "bootstrap"}], "total_count": 25147}
+{"field": "host.labels.value", "buckets": [{"count": 25147, "key": "BULLETPROOF"}, {"count": 208, "key": "IPV6"}], "total_count": 25147}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 2044, "key": "YE2"}, {"count": 1835, "key": "YE1"}, {"count": 1037, "key": "windows-Dallas0"}, {"count": 999, "key": "YR2"}, {"count": 966, "key": "YR1"}, {"count": 867, "key": "invalid2.invalid"}, {"count": 486, "key": "windows-Utah-4g"}, {"count": 417, "key": "windows-Amsterd"}, {"count": 394, "key": "TRAEFIK DEFAULT CERT"}, {"count": 368, "key": "windows-Utah-4H"}, {"count": 361, "key": "www.example.com"}, {"count": 326, "key": "windows-Utah-2g"}, {"count": 289, "key": "Plesk"}, {"count": 286, "key": "AnyDesk Client"}, {"count": 265, "key": "WE1"}], "total_count": 25147, "note": "windows-Dallas0/Utah/Amsterdam cert series = cloned Windows fleet"}
+{"field": "host.operating_system.product", "buckets": [{"count": 13362, "key": "linux"}, {"count": 5624, "key": "windows"}, {"count": 214, "key": "ubuntu"}, {"count": 130, "key": "debian_linux"}, {"count": 102, "key": "routeros"}], "total_count": 25147}