add: bph report iocs and daily drop helper

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson b/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson
new file mode 100644
index 0000000..f80133b
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 1130, "key": "22"}, {"count": 784, "key": "443"}, {"count": 580, "key": "80"}, {"count": 471, "key": "53"}, {"count": 400, "key": "27015"}, {"count": 278, "key": "3389"}, {"count": 105, "key": "8443"}, {"count": 90, "key": "25"}, {"count": 88, "key": "2096"}, {"count": 80, "key": "8080"}, {"count": 67, "key": "111"}, {"count": 59, "key": "135"}, {"count": 52, "key": "2222"}, {"count": 50, "key": "445"}, {"count": 48, "key": "3000"}], "total_count": 1918, "note": "port 27015 (Source Engine/game server) on 400 hosts"}
+{"field": "host.services.software.product", "buckets": [{"count": 1024, "key": "openssh"}, {"count": 751, "key": "nginx"}, {"count": 207, "key": "express"}, {"count": 142, "key": "http_server"}, {"count": 98, "key": "google_web_services"}, {"count": 98, "key": "web_server"}, {"count": 92, "key": "http_api"}, {"count": 90, "key": "dovecot"}, {"count": 66, "key": "caddy"}, {"count": 60, "key": "app_and_api_protector"}, {"count": 60, "key": "ghost"}, {"count": 55, "key": "php"}], "total_count": 1918}
+{"field": "host.labels.value", "buckets": [{"count": 1918, "key": "BULLETPROOF"}, {"count": 27, "key": "IPV6"}], "total_count": 1918}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 185, "key": "YE1"}, {"count": 178, "key": "YE2"}, {"count": 106, "key": "invalid2.invalid"}, {"count": 92, "key": "YR1"}, {"count": 85, "key": "YR2"}, {"count": 61, "key": "windows-DE-Fran"}, {"count": 56, "key": "windows-Frankfu"}, {"count": 55, "key": "172.86.93"}, {"count": 51, "key": "GoGetSSL RSA DV CA"}, {"count": 36, "key": "WE1"}], "total_count": 1918, "note": "windows-DE-Frankfurt cert series; 172.86.93.x subnet cert"}
+{"field": "host.operating_system.product", "buckets": [{"count": 959, "key": "linux"}, {"count": 157, "key": "windows"}, {"count": 23, "key": "proxmox"}, {"count": 16, "key": "debian_linux"}, {"count": 14, "key": "routeros"}], "total_count": 1918}