add: bph report iocs

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson b/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson
new file mode 100644
index 0000000..407b511
--- /dev/null
+++ b/kevlar/2026-08-31/censys/aggregations-AS200593.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 201, "key": "22"}, {"count": 133, "key": "3389"}, {"count": 113, "key": "80"}, {"count": 81, "key": "443"}, {"count": 38, "key": "53"}, {"count": 26, "key": "135"}, {"count": 26, "key": "5985"}, {"count": 23, "key": "21"}, {"count": 21, "key": "25"}, {"count": 20, "key": "143"}], "is_more_than_total_hits": false, "other_count": 310, "query_duration_millis": 245, "total_count": 348}}}
+{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 150, "key": "nginx"}, {"count": 137, "key": "openssh"}, {"count": 60, "key": "dovecot"}, {"count": 35, "key": "parallels_plesk_panel"}, {"count": 35, "key": "prototype"}, {"count": 35, "key": "requirejs"}, {"count": 33, "key": "express"}, {"count": 30, "key": "http_server"}, {"count": 29, "key": "http_api"}, {"count": 24, "key": "plesk"}], "is_more_than_total_hits": false, "other_count": 180, "query_duration_millis": 32, "total_count": 348}}}
+{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 348, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 97, "total_count": 348}}}
+{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 42, "key": "Plesk"}, {"count": 29, "key": "YR1"}, {"count": 24, "key": "YR2"}, {"count": 13, "key": "YE1"}, {"count": 12, "key": "R13"}, {"count": 9, "key": "TRAEFIK DEFAULT CERT"}, {"count": 7, "key": "DESKTOP-GKGI28A"}, {"count": 6, "key": "R12"}, {"count": 6, "key": "ckicksp-1.example.com"}, {"count": 6, "key": "devin-coo-1.example.com"}], "is_more_than_total_hits": false, "other_count": 207, "query_duration_millis": 183, "total_count": 348}}}
+{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 138, "key": "linux"}, {"count": 26, "key": "windows"}, {"count": 3, "key": "proxmox"}, {"count": 2, "key": "debian_linux"}, {"count": 1, "key": "ubuntu"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 262, "total_count": 348}}}