add: bph report iocs

1 files changed, 5 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson b/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson
new file mode 100644
index 0000000..3aaabd1
--- /dev/null
+++ b/kevlar/2026-08-31/censys/aggregations-AS58854.ndjson
@@ -0,0 +1,5 @@
+{"field": "host.services.port", "result": {"result": {"buckets": [{"count": 180, "key": "8887"}, {"count": 177, "key": "80"}, {"count": 163, "key": "443"}, {"count": 116, "key": "0"}, {"count": 82, "key": "8081"}, {"count": 79, "key": "8888"}, {"count": 78, "key": "111"}, {"count": 74, "key": "16257"}, {"count": 74, "key": "16259"}, {"count": 72, "key": "16258"}], "is_more_than_total_hits": false, "other_count": 4440, "query_duration_millis": 120, "total_count": 624}}}
+{"field": "host.services.software.product", "result": {"result": {"buckets": [{"count": 1169, "key": "mysql"}, {"count": 349, "key": "nginx"}, {"count": 228, "key": "python"}, {"count": 183, "key": "wsgiserver"}, {"count": 163, "key": "jquery"}, {"count": 152, "key": "bootstrap"}, {"count": 103, "key": "node_exporter"}, {"count": 79, "key": "openssh"}, {"count": 78, "key": "kestrel_web_server"}, {"count": 72, "key": "cadvisor"}], "is_more_than_total_hits": false, "other_count": 279, "query_duration_millis": 536, "total_count": 624}}}
+{"field": "host.labels.value", "result": {"result": {"buckets": [{"count": 624, "key": "BULLETPROOF"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 102, "total_count": 624}}}
+{"field": "host.services.cert.parsed.issuer.common_name", "result": {"result": {"buckets": [{"count": 47, "key": "GlobalSign RSA OV SSL CA 2018"}, {"count": 13, "key": "TrustAsia DV TLS RSA CA 2025"}, {"count": 10, "key": "FtpServer"}, {"count": 9, "key": "YR1"}, {"count": 8, "key": "RapidSSL TLS RSA CA G1"}, {"count": 6, "key": "TrustAsia DV TLS RSA CA 2024"}, {"count": 5, "key": "IPMI"}, {"count": 5, "key": "WIN-RIK6D08VRRQ"}, {"count": 4, "key": "Firecloud Root Client Certification Authority"}, {"count": 4, "key": "Sectigo Public Server Authentication CA DV R36"}], "is_more_than_total_hits": false, "other_count": 78, "query_duration_millis": 101, "total_count": 624}}}
+{"field": "host.operating_system.product", "result": {"result": {"buckets": [{"count": 33, "key": "linux"}, {"count": 26, "key": "windows"}, {"count": 13, "key": "ubuntu"}, {"count": 2, "key": "routeros"}, {"count": 1, "key": "centos"}], "is_more_than_total_hits": false, "other_count": 0, "query_duration_millis": 411, "total_count": 624}}}