add: bph report iocs and daily drop helper

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson
new file mode 100644
index 0000000..671b715
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 167, "key": "3389"}, {"count": 162, "key": "22"}, {"count": 90, "key": "80"}, {"count": 86, "key": "443"}, {"count": 53, "key": "135"}, {"count": 40, "key": "137"}, {"count": 39, "key": "53"}, {"count": 36, "key": "139"}, {"count": 36, "key": "5985"}, {"count": 26, "key": "47001"}, {"count": 24, "key": "21"}, {"count": 23, "key": "123"}, {"count": 22, "key": "25"}, {"count": 21, "key": "143"}, {"count": 21, "key": "993"}], "total_count": 362}
+{"field": "host.services.software.product", "buckets": [{"count": 129, "key": "nginx"}, {"count": 128, "key": "openssh"}, {"count": 61, "key": "dovecot"}, {"count": 43, "key": "http_api"}, {"count": 33, "key": "express"}, {"count": 33, "key": "http_server"}, {"count": 31, "key": "fastpanel"}, {"count": 26, "key": "exim"}, {"count": 26, "key": "requirejs"}, {"count": 24, "key": "parallels_plesk_panel"}, {"count": 24, "key": "prototype"}, {"count": 17, "key": "proftpd"}], "total_count": 362}
+{"field": "host.labels.value", "buckets": [{"count": 362, "key": "BULLETPROOF"}], "total_count": 362}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 22, "key": "Plesk"}, {"count": 19, "key": "etc"}, {"count": 18, "key": "YR1"}, {"count": 11, "key": "AnyDesk Client"}, {"count": 10, "key": "R11"}, {"count": 10, "key": "R12"}, {"count": 9, "key": "YR2"}, {"count": 9, "key": "localhost"}, {"count": 8, "key": "FASTPANEL"}, {"count": 8, "key": "parking"}], "total_count": 362, "note": "AnyDesk Client issuer CNs = remote-access tool certs on 11 hosts"}
+{"field": "host.operating_system.product", "buckets": [{"count": 120, "key": "linux"}, {"count": 43, "key": "windows"}, {"count": 3, "key": "debian_linux"}, {"count": 3, "key": "proxmox"}], "total_count": 362}