add: bph report iocs and daily drop helper

13 files changed, 63 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/censys/aggregations-AS138915.ndjson b/kevlar/2026-08-23/censys/aggregations-AS138915.ndjson
new file mode 100644
index 0000000..df1b3cc
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS138915.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 7338, "key": "22"}, {"count": 2700, "key": "443"}, {"count": 2507, "key": "80"}, {"count": 2482, "key": "32080"}, {"count": 2428, "key": "43080"}, {"count": 2300, "key": "40003"}, {"count": 2285, "key": "40801"}, {"count": 2284, "key": "40804"}, {"count": 2281, "key": "40803"}, {"count": 2275, "key": "40810"}, {"count": 887, "key": "123"}, {"count": 612, "key": "8080"}, {"count": 591, "key": "3389"}, {"count": 550, "key": "135"}, {"count": 528, "key": "139"}], "total_count": 13631, "note": "high-port proxy pool 32080/43080/40003/408xx ~2.3k each"}
+{"field": "host.services.software.product", "buckets": [{"count": 7688, "key": "openssh"}, {"count": 6325, "key": "openresty"}, {"count": 4776, "key": "tengine"}, {"count": 3348, "key": "nginx"}, {"count": 1025, "key": "http_api"}, {"count": 529, "key": "http_server"}, {"count": 450, "key": "jquery"}, {"count": 432, "key": "express"}, {"count": 326, "key": "bootstrap"}, {"count": 302, "key": "openvpn_access_server"}, {"count": 220, "key": "python"}, {"count": 217, "key": "squid"}], "total_count": 13631}
+{"field": "host.labels.value", "buckets": [{"count": 13631, "key": "BULLETPROOF"}, {"count": 99, "key": "IPV6"}], "total_count": 13631}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 4652, "key": "GlobalSign GCC R3 OV TLS CA 2024"}, {"count": 2439, "key": "localhost"}, {"count": 2367, "key": "prod-vpn.example.com"}, {"count": 2249, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 2209, "key": "GlobalSign GCC R46 OV TLS CA 2025"}, {"count": 1208, "key": "Sectigo Public Server Authentication CA DV R36"}, {"count": 542, "key": "WoTrus RSA DV SSL CA 2"}, {"count": 426, "key": "NONE"}, {"count": 350, "key": "YR1"}, {"count": 339, "key": "WIN-9QFKHJ39QE9"}, {"count": 273, "key": "YR2"}, {"count": 247, "key": "QY"}, {"count": 211, "key": "YE1"}, {"count": 209, "key": "YE2"}, {"count": 180, "key": "tls.internal.ypc.org"}], "total_count": 13631}
+{"field": "host.operating_system.product", "buckets": [{"count": 6128, "key": "linux"}, {"count": 610, "key": "windows"}, {"count": 68, "key": "routeros"}, {"count": 34, "key": "debian_linux"}, {"count": 33, "key": "ubuntu"}, {"count": 32, "key": "centos"}, {"count": 11, "key": "proxmox"}, {"count": 10, "key": "adaptive_security_appliance_software"}], "total_count": 13631}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson b/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson
new file mode 100644
index 0000000..2b0bdd8
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS14956.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 15031, "key": "22"}, {"count": 8402, "key": "443"}, {"count": 7549, "key": "3389"}, {"count": 7374, "key": "80"}, {"count": 1112, "key": "2096"}, {"count": 985, "key": "135"}, {"count": 930, "key": "5985"}, {"count": 864, "key": "8443"}, {"count": 853, "key": "445"}, {"count": 808, "key": "53"}, {"count": 656, "key": "25"}, {"count": 641, "key": "139"}, {"count": 610, "key": "8080"}, {"count": 577, "key": "21"}, {"count": 534, "key": "111"}], "total_count": 25147}
+{"field": "host.services.software.product", "buckets": [{"count": 14145, "key": "openssh"}, {"count": 9964, "key": "nginx"}, {"count": 2488, "key": "express"}, {"count": 1561, "key": "http_server"}, {"count": 1230, "key": "dovecot"}, {"count": 1104, "key": "http_api"}, {"count": 855, "key": "google_web_services"}, {"count": 814, "key": "web_server"}, {"count": 708, "key": "caddy"}, {"count": 666, "key": "jquery"}, {"count": 600, "key": "internet_information_services"}, {"count": 561, "key": "bootstrap"}], "total_count": 25147}
+{"field": "host.labels.value", "buckets": [{"count": 25147, "key": "BULLETPROOF"}, {"count": 208, "key": "IPV6"}], "total_count": 25147}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 2044, "key": "YE2"}, {"count": 1835, "key": "YE1"}, {"count": 1037, "key": "windows-Dallas0"}, {"count": 999, "key": "YR2"}, {"count": 966, "key": "YR1"}, {"count": 867, "key": "invalid2.invalid"}, {"count": 486, "key": "windows-Utah-4g"}, {"count": 417, "key": "windows-Amsterd"}, {"count": 394, "key": "TRAEFIK DEFAULT CERT"}, {"count": 368, "key": "windows-Utah-4H"}, {"count": 361, "key": "www.example.com"}, {"count": 326, "key": "windows-Utah-2g"}, {"count": 289, "key": "Plesk"}, {"count": 286, "key": "AnyDesk Client"}, {"count": 265, "key": "WE1"}], "total_count": 25147, "note": "windows-Dallas0/Utah/Amsterdam cert series = cloned Windows fleet"}
+{"field": "host.operating_system.product", "buckets": [{"count": 13362, "key": "linux"}, {"count": 5624, "key": "windows"}, {"count": 214, "key": "ubuntu"}, {"count": 130, "key": "debian_linux"}, {"count": 102, "key": "routeros"}], "total_count": 25147}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson
new file mode 100644
index 0000000..671b715
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 167, "key": "3389"}, {"count": 162, "key": "22"}, {"count": 90, "key": "80"}, {"count": 86, "key": "443"}, {"count": 53, "key": "135"}, {"count": 40, "key": "137"}, {"count": 39, "key": "53"}, {"count": 36, "key": "139"}, {"count": 36, "key": "5985"}, {"count": 26, "key": "47001"}, {"count": 24, "key": "21"}, {"count": 23, "key": "123"}, {"count": 22, "key": "25"}, {"count": 21, "key": "143"}, {"count": 21, "key": "993"}], "total_count": 362}
+{"field": "host.services.software.product", "buckets": [{"count": 129, "key": "nginx"}, {"count": 128, "key": "openssh"}, {"count": 61, "key": "dovecot"}, {"count": 43, "key": "http_api"}, {"count": 33, "key": "express"}, {"count": 33, "key": "http_server"}, {"count": 31, "key": "fastpanel"}, {"count": 26, "key": "exim"}, {"count": 26, "key": "requirejs"}, {"count": 24, "key": "parallels_plesk_panel"}, {"count": 24, "key": "prototype"}, {"count": 17, "key": "proftpd"}], "total_count": 362}
+{"field": "host.labels.value", "buckets": [{"count": 362, "key": "BULLETPROOF"}], "total_count": 362}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 22, "key": "Plesk"}, {"count": 19, "key": "etc"}, {"count": 18, "key": "YR1"}, {"count": 11, "key": "AnyDesk Client"}, {"count": 10, "key": "R11"}, {"count": 10, "key": "R12"}, {"count": 9, "key": "YR2"}, {"count": 9, "key": "localhost"}, {"count": 8, "key": "FASTPANEL"}, {"count": 8, "key": "parking"}], "total_count": 362, "note": "AnyDesk Client issuer CNs = remote-access tool certs on 11 hosts"}
+{"field": "host.operating_system.product", "buckets": [{"count": 120, "key": "linux"}, {"count": 43, "key": "windows"}, {"count": 3, "key": "debian_linux"}, {"count": 3, "key": "proxmox"}], "total_count": 362}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS200651.ndjson b/kevlar/2026-08-23/censys/aggregations-AS200651.ndjson
new file mode 100644
index 0000000..b936fa8
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS200651.ndjson
@@ -0,0 +1,4 @@
+{"field": "host.services.port", "buckets": [{"count": 2821, "key": "22"}, {"count": 2116, "key": "443"}, {"count": 1915, "key": "80"}, {"count": 383, "key": "53"}, {"count": 287, "key": "25"}, {"count": 238, "key": "587"}, {"count": 225, "key": "993"}, {"count": 200, "key": "111"}, {"count": 189, "key": "143"}, {"count": 170, "key": "110"}, {"count": 152, "key": "2096"}, {"count": 151, "key": "8080"}, {"count": 136, "key": "8443"}, {"count": 135, "key": "21"}, {"count": 95, "key": "2087"}], "total_count": 3779}
+{"field": "host.services.software.product", "buckets": [{"count": 2797, "key": "nginx"}, {"count": 2558, "key": "openssh"}, {"count": 566, "key": "dovecot"}, {"count": 467, "key": "http_server"}, {"count": 381, "key": "cpanel"}, {"count": 315, "key": "express"}, {"count": 264, "key": "exim"}, {"count": 247, "key": "caddy"}, {"count": 240, "key": "openresty"}, {"count": 204, "key": "authoritative_server"}, {"count": 171, "key": "webmail"}, {"count": 166, "key": "jquery"}], "total_count": 3779}
+{"field": "host.labels.value", "buckets": [{"count": 3779, "key": "BULLETPROOF"}, {"count": 120, "key": "IPV6"}], "total_count": 3779}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 651, "key": "YE1"}, {"count": 648, "key": "YR2"}, {"count": 594, "key": "YR1"}, {"count": 583, "key": "YE2"}, {"count": 138, "key": "TRAEFIK DEFAULT CERT"}, {"count": 95, "key": "invalid2.invalid"}, {"count": 66, "key": "www.example.com"}, {"count": 55, "key": "localhost"}, {"count": 42, "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"}, {"count": 41, "key": "WE1"}], "total_count": 3779}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS210644.ndjson b/kevlar/2026-08-23/censys/aggregations-AS210644.ndjson
new file mode 100644
index 0000000..48c43e1
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS210644.ndjson
@@ -0,0 +1,4 @@
+{"field": "host.services.port", "buckets": [{"count": 63171, "key": "22"}, {"count": 36487, "key": "443"}, {"count": 18433, "key": "80"}, {"count": 12877, "key": "2096"}, {"count": 8561, "key": "8443"}, {"count": 6456, "key": "8080"}, {"count": 3650, "key": "2053"}, {"count": 2049, "key": "2222"}, {"count": 1771, "key": "3389"}, {"count": 1273, "key": "51821"}, {"count": 1178, "key": "53"}, {"count": 1118, "key": "8000"}, {"count": 1114, "key": "25"}, {"count": 1103, "key": "3000"}, {"count": 924, "key": "9443"}], "total_count": 72914, "note": "largest Censys footprint of the watched set"}
+{"field": "host.services.software.product", "buckets": [{"count": 62494, "key": "openssh"}, {"count": 30443, "key": "nginx"}, {"count": 7465, "key": "google_web_services"}, {"count": 7465, "key": "web_server"}, {"count": 5789, "key": "ghost"}, {"count": 5786, "key": "app_and_api_protector"}, {"count": 4417, "key": "express"}, {"count": 3421, "key": "caddy"}, {"count": 3312, "key": "waf"}, {"count": 3105, "key": "cloudflare_load_balancer"}, {"count": 2094, "key": "uvicorn"}, {"count": 1596, "key": "http_server"}], "total_count": 72914}
+{"field": "host.labels.value", "buckets": [{"count": 72914, "key": "BULLETPROOF"}, {"count": 479, "key": "IPV6"}], "total_count": 72914}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 13227, "key": "YE2"}, {"count": 13009, "key": "YE1"}, {"count": 7547, "key": "invalid2.invalid"}, {"count": 5096, "key": "YR2"}, {"count": 3337, "key": "YR1"}, {"count": 2241, "key": "WE1"}, {"count": 2190, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 2135, "key": "GeoTrust TLS CA G1"}, {"count": 1538, "key": "Microsoft TLS G2 RSA CA OCSP 04"}, {"count": 1333, "key": "GlobalSign ECC OV SSL CA 2018"}, {"count": 1263, "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"}], "total_count": 72914, "note": "YE-series certs at massive scale: 26k across YE1+YE2"}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS214940.ndjson b/kevlar/2026-08-23/censys/aggregations-AS214940.ndjson
new file mode 100644
index 0000000..1064f8f
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS214940.ndjson
@@ -0,0 +1 @@
+{"field": "host.services.port", "buckets": [], "total_count": 0, "note": "no Censys-visible hosts in this ASN (0 total hits)"}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson b/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson
new file mode 100644
index 0000000..f80133b
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS30823.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 1130, "key": "22"}, {"count": 784, "key": "443"}, {"count": 580, "key": "80"}, {"count": 471, "key": "53"}, {"count": 400, "key": "27015"}, {"count": 278, "key": "3389"}, {"count": 105, "key": "8443"}, {"count": 90, "key": "25"}, {"count": 88, "key": "2096"}, {"count": 80, "key": "8080"}, {"count": 67, "key": "111"}, {"count": 59, "key": "135"}, {"count": 52, "key": "2222"}, {"count": 50, "key": "445"}, {"count": 48, "key": "3000"}], "total_count": 1918, "note": "port 27015 (Source Engine/game server) on 400 hosts"}
+{"field": "host.services.software.product", "buckets": [{"count": 1024, "key": "openssh"}, {"count": 751, "key": "nginx"}, {"count": 207, "key": "express"}, {"count": 142, "key": "http_server"}, {"count": 98, "key": "google_web_services"}, {"count": 98, "key": "web_server"}, {"count": 92, "key": "http_api"}, {"count": 90, "key": "dovecot"}, {"count": 66, "key": "caddy"}, {"count": 60, "key": "app_and_api_protector"}, {"count": 60, "key": "ghost"}, {"count": 55, "key": "php"}], "total_count": 1918}
+{"field": "host.labels.value", "buckets": [{"count": 1918, "key": "BULLETPROOF"}, {"count": 27, "key": "IPV6"}], "total_count": 1918}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 185, "key": "YE1"}, {"count": 178, "key": "YE2"}, {"count": 106, "key": "invalid2.invalid"}, {"count": 92, "key": "YR1"}, {"count": 85, "key": "YR2"}, {"count": 61, "key": "windows-DE-Fran"}, {"count": 56, "key": "windows-Frankfu"}, {"count": 55, "key": "172.86.93"}, {"count": 51, "key": "GoGetSSL RSA DV CA"}, {"count": 36, "key": "WE1"}], "total_count": 1918, "note": "windows-DE-Frankfurt cert series; 172.86.93.x subnet cert"}
+{"field": "host.operating_system.product", "buckets": [{"count": 959, "key": "linux"}, {"count": 157, "key": "windows"}, {"count": 23, "key": "proxmox"}, {"count": 16, "key": "debian_linux"}, {"count": 14, "key": "routeros"}], "total_count": 1918}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS400992.ndjson b/kevlar/2026-08-23/censys/aggregations-AS400992.ndjson
new file mode 100644
index 0000000..6b0fb33
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS400992.ndjson
@@ -0,0 +1,3 @@
+{"field": "host.services.port", "buckets": [{"count": 6493, "key": "22"}, {"count": 3180, "key": "443"}, {"count": 1253, "key": "80"}, {"count": 1015, "key": "2096"}, {"count": 497, "key": "8443"}, {"count": 192, "key": "8080"}, {"count": 180, "key": "2222"}, {"count": 176, "key": "3389"}, {"count": 173, "key": "2053"}, {"count": 113, "key": "25"}, {"count": 101, "key": "53"}, {"count": 89, "key": "500"}, {"count": 78, "key": "1080"}, {"count": 76, "key": "8000"}, {"count": 75, "key": "9443"}], "total_count": 7569}
+{"field": "host.services.software.product", "buckets": [{"count": 5569, "key": "openssh"}, {"count": 1951, "key": "nginx"}, {"count": 902, "key": "google_web_services"}, {"count": 899, "key": "web_server"}, {"count": 433, "key": "app_and_api_protector"}, {"count": 433, "key": "ghost"}, {"count": 261, "key": "waf"}, {"count": 251, "key": "caddy"}, {"count": 245, "key": "cloudflare_load_balancer"}, {"count": 231, "key": "express"}, {"count": 208, "key": "traffic_server"}, {"count": 138, "key": "http_server"}], "total_count": 7569}
+{"field": "host.labels.value", "buckets": [{"count": 7569, "key": "BULLETPROOF"}, {"count": 37, "key": "IPV6"}], "total_count": 7569}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS51396.ndjson b/kevlar/2026-08-23/censys/aggregations-AS51396.ndjson
new file mode 100644
index 0000000..a52ea7d
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS51396.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 833, "key": "22"}, {"count": 367, "key": "80"}, {"count": 288, "key": "443"}, {"count": 136, "key": "3389"}, {"count": 100, "key": "1407"}, {"count": 99, "key": "11407"}, {"count": 98, "key": "135"}, {"count": 98, "key": "445"}, {"count": 92, "key": "5985"}, {"count": 90, "key": "139"}, {"count": 81, "key": "53"}, {"count": 75, "key": "47001"}, {"count": 74, "key": "2096"}, {"count": 73, "key": "111"}, {"count": 68, "key": "8080"}], "total_count": 1856, "note": "prior week 1910 hosts; -2.9%"}
+{"field": "host.services.software.product", "buckets": [{"count": 744, "key": "openssh"}, {"count": 402, "key": "nginx"}, {"count": 199, "key": "http_server"}, {"count": 132, "key": "express"}, {"count": 130, "key": "http_api"}, {"count": 79, "key": "php"}, {"count": 61, "key": "pve"}, {"count": 61, "key": "virtual_environment"}, {"count": 54, "key": "jquery"}, {"count": 51, "key": "dovecot"}, {"count": 50, "key": "python"}, {"count": 35, "key": "node_exporter"}], "total_count": 1856}
+{"field": "host.labels.value", "buckets": [{"count": 1856, "key": "BULLETPROOF"}, {"count": 15, "key": "IPV6"}], "total_count": 1856}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 116, "key": "YE1"}, {"count": 95, "key": "YE2"}, {"count": 51, "key": "YR2"}, {"count": 50, "key": "YR1"}, {"count": 28, "key": "Proxmox Virtual Environment"}, {"count": 26, "key": "WIN-9QL4SDRB93L"}, {"count": 21, "key": "TRAEFIK DEFAULT CERT"}, {"count": 21, "key": "WIN-IK7N6SD2UBU"}, {"count": 21, "key": "invalid2.invalid"}, {"count": 21, "key": "localhost"}, {"count": 14, "key": "Cloudbase-Init WinRM"}, {"count": 12, "key": "Plesk"}, {"count": 11, "key": "WIN-TVJFV24LUKT"}, {"count": 9, "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"}, {"count": 9, "key": "WIN-OU0SUKQBJN2"}], "total_count": 1856, "note": "YE1 grew 101->116; YE2 93->95; YR1 61->50 declined"}
+{"field": "host.operating_system.product", "buckets": [{"count": 672, "key": "linux"}, {"count": 93, "key": "windows"}, {"count": 38, "key": "debian_linux"}, {"count": 28, "key": "proxmox"}, {"count": 14, "key": "ubuntu"}, {"count": 4, "key": "centos"}, {"count": 3, "key": "routeros"}, {"count": 2, "key": "windows_server"}], "total_count": 1856}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS51852.ndjson b/kevlar/2026-08-23/censys/aggregations-AS51852.ndjson
new file mode 100644
index 0000000..2b26e43
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS51852.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "buckets": [{"count": 4333, "key": "443"}, {"count": 4031, "key": "22"}, {"count": 3481, "key": "161"}, {"count": 2777, "key": "80"}, {"count": 1889, "key": "123"}, {"count": 1548, "key": "53"}, {"count": 829, "key": "25"}, {"count": 827, "key": "500"}, {"count": 810, "key": "21"}, {"count": 793, "key": "143"}, {"count": 781, "key": "110"}, {"count": 779, "key": "993"}, {"count": 669, "key": "587"}, {"count": 657, "key": "1194"}, {"count": 584, "key": "8082"}], "total_count": 8568}
+{"field": "host.services.software.product", "buckets": [{"count": 4642, "key": "nginx"}, {"count": 4006, "key": "openssh"}, {"count": 2437, "key": "dovecot"}, {"count": 1288, "key": "exim"}, {"count": 816, "key": "openvpn_access_server"}, {"count": 759, "key": "bind"}, {"count": 723, "key": "cpanel"}, {"count": 706, "key": "http_server"}, {"count": 596, "key": "ceph"}, {"count": 474, "key": "webmail"}, {"count": 377, "key": "php"}, {"count": 364, "key": "proftpd"}], "total_count": 8568}
+{"field": "host.labels.value", "buckets": [{"count": 8568, "key": "BULLETPROOF"}, {"count": 39, "key": "IPV6"}], "total_count": 8568}
+{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 1845, "key": "server"}, {"count": 1442, "key": "YR2"}, {"count": 925, "key": "YR1"}, {"count": 769, "key": "Hydra Authentication RSA SubCA #156"}, {"count": 765, "key": "server.domain.com"}, {"count": 482, "key": "YE2"}, {"count": 428, "key": "YE1"}, {"count": 296, "key": "Hydra Authentication RSA SubCA #155"}, {"count": 272, "key": "''"}, {"count": 258, "key": "invalid2.invalid"}, {"count": 185, "key": "server.ibras.eu"}, {"count": 161, "key": "Proxmox Virtual Environment"}, {"count": 156, "key": "Plesk"}, {"count": 108, "key": "server.xtreme-results.net"}, {"count": 93, "key": "localhost"}], "total_count": 8568}
+{"field": "host.operating_system.product", "buckets": [{"count": 3023, "key": "linux"}, {"count": 201, "key": "windows"}, {"count": 159, "key": "proxmox"}, {"count": 129, "key": "enterprise_linux"}, {"count": 45, "key": "ubuntu"}, {"count": 35, "key": "debian_linux"}, {"count": 28, "key": "freebsd"}, {"count": 25, "key": "centos"}], "total_count": 8568}
diff --git a/kevlar/2026-08-23/censys/aggregations-AS57043.ndjson b/kevlar/2026-08-23/censys/aggregations-AS57043.ndjson
new file mode 100644
index 0000000..8a30044
--- /dev/null
+++ b/kevlar/2026-08-23/censys/aggregations-AS57043.ndjson
@@ -0,0 +1,2 @@
+{"field": "host.services.port", "buckets": [{"count": 77197, "key": "22"}, {"count": 50528, "key": "443"}, {"count": 32399, "key": "80"}, {"count": 15216, "key": "2096"}, {"count": 8611, "key": "8443"}, {"count": 4341, "key": "111"}, {"count": 2991, "key": "8080"}, {"count": 2635, "key": "2053"}, {"count": 2622, "key": "2222"}, {"count": 2481, "key": "53"}, {"count": 2235, "key": "9100"}, {"count": 1848, "key": "21"}, {"count": 1833, "key": "8000"}, {"count": 1787, "key": "25"}, {"count": 1768, "key": "1881"}], "total_count": 101477}
+{"field": "host.labels.value", "buckets": [{"count": 101477, "key": "BULLETPROOF"}, {"count": 9, "key": "IPV6"}], "total_count": 101477}
diff --git a/kevlar/2026-08-23/censys/fleet-correlation.csv b/kevlar/2026-08-23/censys/fleet-correlation.csv
new file mode 100644
index 0000000..58a3ab3
--- /dev/null
+++ b/kevlar/2026-08-23/censys/fleet-correlation.csv
@@ -0,0 +1,9 @@
+linkage_type,ips,indicator,asn,notes
+shared_hassh,81.17.28.131 + 204.76.203.221/214 (prior weeks),hassh 41ff3ecd1458b0bf86e1b4891636213e,AS51852<->AS51396,Cross-AS shared SSH server config persists week 3; ties PLI-AS scanner to PFCLOUD clone fleet
+clone_service_profile,204.76.203.225/.224/.226,ClickHouse 9000/8123 + proxy 9191 + Minecraft 25565,AS51396,Identical service stack across proxy-fleet nodes; .225 idle since 08-20 but infrastructure unchanged
+xray_panel_certs,YE1/YE2/YR1/YR2 across AS51396(116/95/50/51) AS57043 AS14956(1835/2044/966/999) AS51852(428/482/925/1442) AS200651(651/583/594/648) AS30823(185/178/92/85) AS210644(13009/13227/3337/5096),"X-UI/Xray panel cert series; AEZA alone carries 26k+ YE-series certs",multi,Cross-ASN Xray/panel fleet persists at scale; strongest signal in AEZA and RouterHosting
+cloned_windows_certs,windows-Dallas0(1037) windows-Utah-4g/4H/2g(~1180) windows-Amsterd(417) windows-DE-Fran/Frankfu(117) 172.86.93(55),Windows self-signed cert series reused across many hosts,AS14956 + AS30823,Cloned Windows images in RouterHosting and aurologic ranges; 172.86.93.x cert = RouterHosting subnet cert on aurologic ASN
+compromised_corporate_dc,erp01.ad.reiscrew.de (45.11.18.33),AD domain reiscrew.de; LDAP rootDSE + SMB 3.0.2 + RDP RDSTLS,AS30823,German company AD/ERP server on bulletproof ASN doubles as RDP masscan node
+beacon_infrastructure,185.100.87.136,Tor exit; POST /api/checkin + transparentpix.gif; ja4 t13i1909h2_9dc949149365_97f8aa674fd9,AS200651,Endpoint rotated from /api/client/update (SPARK COMMIT) to /api/checkin; same host second week
+proxy_validation_network,204.76.203.7 + 45.135.194.113 + 45.135.193.193,azenv.net + proxy.flarevpn.digital:8080/judge + httpbin.org CONNECT + socks5 \u0005\u0001\u0000,AS51396,Go-http-client/1.1 fleet validating open proxies; GreyNoise tags Ivanti/Pulse/F5/CrushFTP scanners
+port_sprawl_farm,38.54.2.209 + 38.54.2.13/.61/.75/.152/.221/.232,HTTP listeners on ~100 random ports each,AS138915,940k+ Sponge sessions; each /32 answers HTTP on arbitrary ports -- masscan-response farm or proxy pool
diff --git a/kevlar/2026-08-23/censys/ip-enrichments.ndjson b/kevlar/2026-08-23/censys/ip-enrichments.ndjson
new file mode 100644
index 0000000..7f039a4
--- /dev/null
+++ b/kevlar/2026-08-23/censys/ip-enrichments.ndjson
@@ -0,0 +1,10 @@
+{"ip":"176.120.22.61","asn":198953,"org":"Proton66 OOO","country":"RU","labels":["BULLETPROOF"],"os":"windows","hostname":"M051108","services":[{"port":135,"protocol":"DCERPC","note":"MS-SCMR/MS-SAMR/MS-RPRN bindings exposed; REMOTE_ACCESS label"},{"port":137,"protocol":"NETBIOS","note":"exposed"},{"port":139,"protocol":"NETBIOS","note":"exposed"},{"port":3389,"protocol":"RDP","note":"self-signed CN=M051108 SHA1-RSA cert, valid to 2027-02-12; screenshot captured"},{"port":5985,"protocol":"WINRM","note":"Microsoft-HTTPAPI/2.0 404"},{"port":47001,"protocol":"WINRM","note":"Microsoft-HTTPAPI/2.0 404"}],"note":"mssql-tds sweeper (598 events this week); box itself fully exposed; unchanged from prior week"}
+{"ip":"45.11.18.33","asn":30823,"org":"aurologic GmbH","country":"DE","labels":["BULLETPROOF"],"os":"windows_server_2016","hostname":"erp01.ad.reiscrew.de","services":[{"port":389,"protocol":"LDAP","note":"AD rootDSE leaks domain ad.reiscrew.de, host erp01, USN 21300127"},{"port":443,"protocol":"HTTPS","note":"IIS 10.0 default page; self-signed CN=erp01.ad.reiscrew.de"},{"port":445,"protocol":"SMB","note":"SMB 3.0.2, NTLM, target name AD; critical exposure CENSYS-2022-1063"},{"port":3389,"protocol":"RDP","note":"RDSTLS restricted-admin; self-signed cert renewed 2026-08-16"},{"port":5985,"protocol":"WINRM","note":"exposed"}],"note":"Windows Server 2016 AD domain controller for reiscrew.de; doubles as RDP masscan (Cookie: mstshash=hello, 455 events). Compromised corporate DC running from aurologic 'Network used for hosting/infrastructure' 45.11.18.0/24"}
+{"ip":"204.76.203.7","asn":51396,"org":"Pfcloud UG / Intelligence Hosting LLC","country":"NL","labels":["BULLETPROOF"],"os":"ubuntu","services":[{"port":22,"protocol":"SSH","note":"OpenSSH 9.6p1 Ubuntu; hassh e42184b06d45385a906f0803d04c83da"},{"port":9001,"protocol":"HTTP","note":"nginx/1.24.0 Ubuntu 403"}],"greynoise":"malicious; tags: Ivanti/Pulse Secure/F5 BIG-IP/CrushFTP/Sophos scanners, Open Proxy Scanner, SOCKS5 Proxy Scanner, Wordpress Enumeration","note":"proxy-validation node: azenv.net + httpbin.org CONNECT + socks5 judges; whois shows Intelligence Hosting LLC behind PFCLOUD 204.76.203.0/24"}
+{"ip":"107.189.26.103","asn":14956,"org":"RouterHosting LLC (Cloudzy)","country":"NL","labels":["BULLETPROOF"],"reverse_dns":"103.26.189.107.static.cloudzy.com","services":[{"port":500,"protocol":"IKE","note":"VPN endpoint (IKEv1 accepted proposal)"},{"port":1701,"protocol":"L2TP","note":"hostname sasradius, vendor xelerance.com (Openswan/Libreswan)"},{"port":80,"protocol":"HTTP","note":"Apache 2.4.29"}],"note":"libredtail-http PHPUnit eval-stdin.php sweep (99 events) + ThinkPHP RCE + Docker /containers/json probes; legacy Apache 2.4.29 with critical CVEs; L2TP VPN box"}
+{"ip":"81.17.28.131","asn":51852,"org":"Private Layer INC","country":"CH","labels":["BULLETPROOF"],"reverse_dns":"hostedby.privatelayer.com","services":[{"port":22,"protocol":"SSH","note":"OpenSSH 8.9p1 Ubuntu; hassh 41ff3ecd1458b0bf86e1b4891636213e"}],"greynoise":"unknown; tags: DCERPC Protocol, Ping Scanner, TLS/SSL Crawler, Web Crawler","note":"SAME HASSH as PFCLOUD clone pair 204.76.203.221/214 (prior weeks) -- cross-AS shared SSH config persists. DCE/RPC + port 8899 scanner"}
+{"ip":"46.19.138.42","asn":51852,"org":"Private Layer INC","country":"CH","labels":["BULLETPROOF"],"reverse_dns":"hostedby.privatelayer.com","services":[{"port":22,"protocol":"SSH"},{"port":80,"protocol":"HTTP"},{"port":443,"protocol":"HTTP"},{"port":3000,"protocol":"HTTP","note":"new since 2026-08-18"},{"port":4000,"protocol":"HTTP"},{"port":8888,"protocol":"HTTP"}],"note":"marketmaker-bot scanner: mmsk-scout/mm-scout UA probing /version /pairs /v6/marketmaker/status/1 on ports 8001/8100/9000/9001"}
+{"ip":"179.43.150.26","asn":51852,"org":"Private Layer INC","country":"CH","labels":["BULLETPROOF"],"reverse_dns":"hostedby.privatelayer.com","services":[{"port":22,"protocol":"SSH","note":"only live service; WinRM 5985 seen Sep 2025 only"}],"note":".env + random-path prober (/z875 /.e9951 /s/6051) against Vite dev server port 5173"}
+{"ip":"185.100.87.136","asn":200651,"org":"FlokiNET ehf","country":"RO","labels":["BULLETPROOF","PROXY_SERVER"],"privacy":"tor exit","services":[{"port":80,"protocol":"HTTP","note":"Tor exit notice page"},{"port":7288,"protocol":"SSH","note":"non-standard SSH"},{"port":9001,"protocol":"UNKNOWN","note":"Tor OR port"}],"note":"beacon host: POST /api/checkin (8443), GET /images/transparentpix.gif (443, TLS1.3 ChaCha20, ja4 t13i1909h2_9dc949149365_97f8aa674fd9), binary 16-byte probes; endpoint rotated from last week's /api/client/update SPARK COMMIT"}
+{"ip":"38.54.2.209","asn":138915,"org":"Kaopu Cloud HK Limited","country":"HK","labels":["BULLETPROOF"],"services":[{"ports":"~100+ open","protocol":"HTTP","note":"HTTP on ports 23/53/74/943/1963/2112/5901/6443/9200/27017/44818 etc; SSH 22/2222; Telnet 23/2323"}],"note":"946k lifetime Sponge sessions, 43k this week, 940k+ sessions from 38.54.2.x cluster; port-sprawl farm -- HTTP listeners on nearly every scanned port; top Sponge talker in the watched set"}
+{"ip":"204.76.203.225","asn":51396,"org":"Pfcloud UG","country":"NL","labels":["BULLETPROOF"],"services":[{"port":9000,"protocol":"CLICKHOUSE_NATIVE"},{"port":8123,"protocol":"HTTP","note":"ClickHouse web UI"},{"port":9191,"protocol":"HTTP","note":"proxy port"},{"port":25565,"protocol":"MINECRAFT"},{"port":3000,"protocol":"HTTP","note":"new since 2026-04"}],"note":"proxy-fleet node; same ClickHouse+proxy profile as .224/.226 clone pair from prior weeks; 1872 events this week, idle since 08-20"}