add: bph report iocs

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson b/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson
new file mode 100644
index 0000000..48305e4
--- /dev/null
+++ b/kevlar/2026-08-31/censys/aggregations-AS140666.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 1652, "key": "22"}, {"count": 694, "key": "443"}, {"count": 535, "key": "80"}, {"count": 376, "key": "6004"}, {"count": 376, "key": "6011"}, {"count": 375, "key": "6001"}, {"count": 375, "key": "6006"}, {"count": 375, "key": "6007"}, {"count": 375, "key": "6010"}, {"count": 375, "key": "6012"}], "is_more_than_total_hits": false, "other_count": 12271, "query_duration_millis": 32, "total_count": 2805}}}
+{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1615, "key": "openssh"}, {"count": 1378, "key": "nginx"}, {"count": 146, "key": "openresty"}, {"count": 131, "key": "http_api"}, {"count": 80, "key": "jquery"}, {"count": 74, "key": "internet_information_services"}, {"count": 58, "key": "tengine"}, {"count": 54, "key": "bootstrap"}, {"count": 39, "key": "express"}, {"count": 36, "key": "node_exporter"}], "is_more_than_total_hits": false, "other_count": 575, "query_duration_millis": 168, "total_count": 2805}}}
+{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 2805, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 244, "total_count": 2805}}}
+{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 338, "key": "Sectigo Public Server Authentication CA DV R36"}, {"count": 183, "key": "NONE"}, {"count": 135, "key": "RapidSSL TLS RSA CA G1"}, {"count": 109, "key": "tudog_node_agent._reserved.bytefcdn.com"}, {"count": 107, "key": "RTCTS"}, {"count": 102, "key": "GeoTrust TLS RSA CA G1"}, {"count": 92, "key": "QY"}, {"count": 65, "key": "RapidSSL TLS ECC CA G1"}, {"count": 60, "key": "tls.internal.ypc.org"}, {"count": 47, "key": "GlobalSign GCC R3 OV TLS CA 2024"}], "is_more_than_total_hits": false, "other_count": 717, "query_duration_millis": 67, "total_count": 2805}}}
+{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 1089, "key": "linux"}, {"count": 95, "key": "windows"}, {"count": 13, "key": "ubuntu"}, {"count": 3, "key": "routeros"}, {"count": 2, "key": "adaptive_security_appliance_software"}, {"count": 2, "key": "debian_linux"}, {"count": 1, "key": "linux_kernel"}, {"count": 1, "key": "proxmox"}, {"count": 1, "key": "windows_server_2008_r2"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 20, "total_count": 2805}}}