add: bph report iocs

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson b/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson
new file mode 100644
index 0000000..b59c7c8
--- /dev/null
+++ b/kevlar/2026-08-31/censys/aggregations-AS200651.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 2841, "key": "22"}, {"count": 2118, "key": "443"}, {"count": 1917, "key": "80"}, {"count": 380, "key": "53"}, {"count": 282, "key": "25"}, {"count": 234, "key": "587"}, {"count": 222, "key": "993"}, {"count": 189, "key": "111"}, {"count": 186, "key": "143"}, {"count": 168, "key": "110"}], "is_more_than_total_hits": false, "other_count": 4831, "query_duration_millis": 180, "total_count": 3806}}}
+{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 2825, "key": "nginx"}, {"count": 2589, "key": "openssh"}, {"count": 585, "key": "dovecot"}, {"count": 465, "key": "http_server"}, {"count": 361, "key": "cpanel"}, {"count": 303, "key": "express"}, {"count": 270, "key": "exim"}, {"count": 258, "key": "caddy"}, {"count": 247, "key": "openresty"}, {"count": 196, "key": "authoritative_server"}], "is_more_than_total_hits": false, "other_count": 3469, "query_duration_millis": 79, "total_count": 3806}}}
+{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 3806, "key": "BULLETPROOF"}, {"count": 130, "key": "IPV6"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 20, "total_count": 3806}}}
+{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 725, "key": "YE1"}, {"count": 637, "key": "YR2"}, {"count": 612, "key": "YE2"}, {"count": 562, "key": "YR1"}, {"count": 131, "key": "TRAEFIK DEFAULT CERT"}, {"count": 99, "key": "invalid2.invalid"}, {"count": 59, "key": "localhost"}, {"count": 47, "key": "WE1"}, {"count": 40, "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"}, {"count": 40, "key": "www.example.com"}], "is_more_than_total_hits": false, "other_count": 1621, "query_duration_millis": 128, "total_count": 3806}}}
+{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 2167, "key": "linux"}, {"count": 56, "key": "ubuntu"}, {"count": 48, "key": "debian_linux"}, {"count": 30, "key": "proxmox"}, {"count": 27, "key": "windows"}, {"count": 10, "key": "freebsd"}, {"count": 8, "key": "routeros"}, {"count": 6, "key": "enterprise_linux"}, {"count": 6, "key": "openbsd"}, {"count": 5, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 8, "query_duration_millis": 162, "total_count": 3806}}}