aboutsummaryrefslogtreecommitdiff
path: root/kevlar/2026-08-31/censys/aggregations-all.json
diff options
context:
space:
mode:
authorhrbrmstr <bob@rud.is>2026-08-31 07:56:38 -0400
committerhrbrmstr <bob@rud.is>2026-08-31 07:56:38 -0400
commite93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch)
treee02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/censys/aggregations-all.json
parent1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff)
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/censys/aggregations-all.json')
-rw-r--r--kevlar/2026-08-31/censys/aggregations-all.json4907
1 files changed, 4907 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/censys/aggregations-all.json b/kevlar/2026-08-31/censys/aggregations-all.json
new file mode 100644
index 0000000..2280a60
--- /dev/null
+++ b/kevlar/2026-08-31/censys/aggregations-all.json
@@ -0,0 +1,4907 @@
+{
+ "AS57043": {
+ "name": "HOSTKEY-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 77135,
+ "key": "22"
+ },
+ {
+ "count": 49750,
+ "key": "443"
+ },
+ {
+ "count": 32331,
+ "key": "80"
+ },
+ {
+ "count": 14629,
+ "key": "2096"
+ },
+ {
+ "count": 8459,
+ "key": "8443"
+ },
+ {
+ "count": 4010,
+ "key": "111"
+ },
+ {
+ "count": 2912,
+ "key": "8080"
+ },
+ {
+ "count": 2598,
+ "key": "2222"
+ },
+ {
+ "count": 2515,
+ "key": "2053"
+ },
+ {
+ "count": 2258,
+ "key": "53"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 125759,
+ "query_duration_millis": 220,
+ "total_count": 101011
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 76785,
+ "key": "openssh"
+ },
+ {
+ "count": 59721,
+ "key": "nginx"
+ },
+ {
+ "count": 8938,
+ "key": "google_web_services"
+ },
+ {
+ "count": 8936,
+ "key": "web_server"
+ },
+ {
+ "count": 6500,
+ "key": "ghost"
+ },
+ {
+ "count": 6499,
+ "key": "app_and_api_protector"
+ },
+ {
+ "count": 5458,
+ "key": "express"
+ },
+ {
+ "count": 3900,
+ "key": "caddy"
+ },
+ {
+ "count": 3435,
+ "key": "waf"
+ },
+ {
+ "count": 3313,
+ "key": "cloudflare_load_balancer"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 57657,
+ "query_duration_millis": 372,
+ "total_count": 101011
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 101011,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 8,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 171,
+ "total_count": 101011
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 13508,
+ "key": "YE2"
+ },
+ {
+ "count": 13247,
+ "key": "YE1"
+ },
+ {
+ "count": 9044,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 4967,
+ "key": "YR1"
+ },
+ {
+ "count": 4513,
+ "key": "YR2"
+ },
+ {
+ "count": 2378,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 2369,
+ "key": "WE1"
+ },
+ {
+ "count": 2034,
+ "key": "TRAEFIK DEFAULT CERT"
+ },
+ {
+ "count": 1748,
+ "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"
+ },
+ {
+ "count": 1538,
+ "key": "Microsoft TLS G2 RSA CA OCSP 04"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 35502,
+ "query_duration_millis": 171,
+ "total_count": 101011
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 72754,
+ "key": "linux"
+ },
+ {
+ "count": 800,
+ "key": "ubuntu"
+ },
+ {
+ "count": 573,
+ "key": "windows"
+ },
+ {
+ "count": 305,
+ "key": "routeros"
+ },
+ {
+ "count": 273,
+ "key": "debian_linux"
+ },
+ {
+ "count": 180,
+ "key": "proxmox"
+ },
+ {
+ "count": 139,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 108,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 55,
+ "key": "freebsd"
+ },
+ {
+ "count": 44,
+ "key": "centos"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 132,
+ "query_duration_millis": 61,
+ "total_count": 101011
+ }
+ }
+ }
+ },
+ "AS209847": {
+ "name": "THE",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 980,
+ "key": "22"
+ },
+ {
+ "count": 564,
+ "key": "8080"
+ },
+ {
+ "count": 517,
+ "key": "1030"
+ },
+ {
+ "count": 517,
+ "key": "1050"
+ },
+ {
+ "count": 514,
+ "key": "24442"
+ },
+ {
+ "count": 499,
+ "key": "1235"
+ },
+ {
+ "count": 494,
+ "key": "1234"
+ },
+ {
+ "count": 440,
+ "key": "443"
+ },
+ {
+ "count": 419,
+ "key": "53"
+ },
+ {
+ "count": 387,
+ "key": "80"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2363,
+ "query_duration_millis": 111,
+ "total_count": 1784
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1567,
+ "key": "python"
+ },
+ {
+ "count": 1554,
+ "key": "aiohttp"
+ },
+ {
+ "count": 1231,
+ "key": "openssh"
+ },
+ {
+ "count": 723,
+ "key": "nginx"
+ },
+ {
+ "count": 367,
+ "key": "bind"
+ },
+ {
+ "count": 312,
+ "key": "dovecot"
+ },
+ {
+ "count": 217,
+ "key": "exim"
+ },
+ {
+ "count": 201,
+ "key": "proftpd"
+ },
+ {
+ "count": 130,
+ "key": "google_web_services"
+ },
+ {
+ "count": 130,
+ "key": "web_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 737,
+ "query_duration_millis": 109,
+ "total_count": 1784
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1784,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 5,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 190,
+ "total_count": 1784
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 221,
+ "key": "YR1"
+ },
+ {
+ "count": 203,
+ "key": "YR2"
+ },
+ {
+ "count": 132,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 121,
+ "key": "YE2"
+ },
+ {
+ "count": 107,
+ "key": "YE1"
+ },
+ {
+ "count": 30,
+ "key": "server"
+ },
+ {
+ "count": 22,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 21,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 19,
+ "key": "Sectigo Public Server Authentication CA DV E36"
+ },
+ {
+ "count": 17,
+ "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1073,
+ "query_duration_millis": 118,
+ "total_count": 1784
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1210,
+ "key": "linux"
+ },
+ {
+ "count": 42,
+ "key": "ubuntu"
+ },
+ {
+ "count": 14,
+ "key": "windows"
+ },
+ {
+ "count": 5,
+ "key": "routeros"
+ },
+ {
+ "count": 2,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 1,
+ "key": "centos"
+ },
+ {
+ "count": 1,
+ "key": "debian_linux"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 125,
+ "total_count": 1784
+ }
+ }
+ }
+ },
+ "AS210644": {
+ "name": "AEZA-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 62401,
+ "key": "22"
+ },
+ {
+ "count": 35627,
+ "key": "443"
+ },
+ {
+ "count": 18220,
+ "key": "80"
+ },
+ {
+ "count": 12493,
+ "key": "2096"
+ },
+ {
+ "count": 8314,
+ "key": "8443"
+ },
+ {
+ "count": 6208,
+ "key": "8080"
+ },
+ {
+ "count": 3499,
+ "key": "2053"
+ },
+ {
+ "count": 1995,
+ "key": "2222"
+ },
+ {
+ "count": 1737,
+ "key": "3389"
+ },
+ {
+ "count": 1158,
+ "key": "53"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 59626,
+ "query_duration_millis": 77,
+ "total_count": 72191
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 61805,
+ "key": "openssh"
+ },
+ {
+ "count": 30153,
+ "key": "nginx"
+ },
+ {
+ "count": 7299,
+ "key": "google_web_services"
+ },
+ {
+ "count": 7299,
+ "key": "web_server"
+ },
+ {
+ "count": 5523,
+ "key": "ghost"
+ },
+ {
+ "count": 5521,
+ "key": "app_and_api_protector"
+ },
+ {
+ "count": 4247,
+ "key": "express"
+ },
+ {
+ "count": 3438,
+ "key": "caddy"
+ },
+ {
+ "count": 3128,
+ "key": "waf"
+ },
+ {
+ "count": 2926,
+ "key": "cloudflare_load_balancer"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 34593,
+ "query_duration_millis": 158,
+ "total_count": 72191
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 72191,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 509,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 238,
+ "total_count": 72191
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 13117,
+ "key": "YE2"
+ },
+ {
+ "count": 13008,
+ "key": "YE1"
+ },
+ {
+ "count": 7385,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 5097,
+ "key": "YR2"
+ },
+ {
+ "count": 3278,
+ "key": "YR1"
+ },
+ {
+ "count": 2117,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 2056,
+ "key": "WE1"
+ },
+ {
+ "count": 1819,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 1341,
+ "key": "Microsoft TLS G2 RSA CA OCSP 04"
+ },
+ {
+ "count": 1288,
+ "key": "GlobalSign ECC OV SSL CA 2018"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 25046,
+ "query_duration_millis": 193,
+ "total_count": 72191
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 60420,
+ "key": "linux"
+ },
+ {
+ "count": 719,
+ "key": "ubuntu"
+ },
+ {
+ "count": 573,
+ "key": "windows"
+ },
+ {
+ "count": 209,
+ "key": "debian_linux"
+ },
+ {
+ "count": 84,
+ "key": "routeros"
+ },
+ {
+ "count": 83,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 34,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 14,
+ "key": "linux_ami"
+ },
+ {
+ "count": 13,
+ "key": "centos"
+ },
+ {
+ "count": 12,
+ "key": "windows_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 16,
+ "query_duration_millis": 56,
+ "total_count": 72191
+ }
+ }
+ }
+ },
+ "AS138915": {
+ "name": "KAOPU-HK (Kaopu Cloud HK Limited)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7319,
+ "key": "22"
+ },
+ {
+ "count": 2669,
+ "key": "443"
+ },
+ {
+ "count": 2501,
+ "key": "80"
+ },
+ {
+ "count": 2430,
+ "key": "32080"
+ },
+ {
+ "count": 2379,
+ "key": "43080"
+ },
+ {
+ "count": 2243,
+ "key": "40003"
+ },
+ {
+ "count": 2238,
+ "key": "40801"
+ },
+ {
+ "count": 2235,
+ "key": "40803"
+ },
+ {
+ "count": 2234,
+ "key": "40804"
+ },
+ {
+ "count": 2229,
+ "key": "40810"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 62162,
+ "query_duration_millis": 306,
+ "total_count": 13554
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7679,
+ "key": "openssh"
+ },
+ {
+ "count": 6327,
+ "key": "openresty"
+ },
+ {
+ "count": 4526,
+ "key": "tengine"
+ },
+ {
+ "count": 3369,
+ "key": "nginx"
+ },
+ {
+ "count": 1055,
+ "key": "http_api"
+ },
+ {
+ "count": 553,
+ "key": "http_server"
+ },
+ {
+ "count": 435,
+ "key": "express"
+ },
+ {
+ "count": 430,
+ "key": "jquery"
+ },
+ {
+ "count": 309,
+ "key": "bootstrap"
+ },
+ {
+ "count": 309,
+ "key": "openvpn_access_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4900,
+ "query_duration_millis": 154,
+ "total_count": 13554
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 13554,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 99,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 470,
+ "total_count": 13554
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4619,
+ "key": "GlobalSign GCC R3 OV TLS CA 2024"
+ },
+ {
+ "count": 2393,
+ "key": "localhost"
+ },
+ {
+ "count": 2346,
+ "key": "prod-vpn.example.com"
+ },
+ {
+ "count": 2310,
+ "key": "GlobalSign GCC R46 OV TLS CA 2025"
+ },
+ {
+ "count": 2240,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 1206,
+ "key": "Sectigo Public Server Authentication CA DV R36"
+ },
+ {
+ "count": 431,
+ "key": "NONE"
+ },
+ {
+ "count": 431,
+ "key": "WoTrus RSA DV SSL CA 2"
+ },
+ {
+ "count": 361,
+ "key": "YR1"
+ },
+ {
+ "count": 345,
+ "key": "WIN-9QFKHJ39QE9"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 7531,
+ "query_duration_millis": 511,
+ "total_count": 13554
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6092,
+ "key": "linux"
+ },
+ {
+ "count": 626,
+ "key": "windows"
+ },
+ {
+ "count": 66,
+ "key": "routeros"
+ },
+ {
+ "count": 36,
+ "key": "ubuntu"
+ },
+ {
+ "count": 33,
+ "key": "debian_linux"
+ },
+ {
+ "count": 31,
+ "key": "centos"
+ },
+ {
+ "count": 10,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 10,
+ "key": "proxmox"
+ },
+ {
+ "count": 4,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 3,
+ "key": "freebsd"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 10,
+ "query_duration_millis": 195,
+ "total_count": 13554
+ }
+ }
+ }
+ },
+ "AS14956": {
+ "name": "ROUTERHOSTING (RouterHosting LLC)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 15480,
+ "key": "22"
+ },
+ {
+ "count": 8450,
+ "key": "443"
+ },
+ {
+ "count": 7520,
+ "key": "3389"
+ },
+ {
+ "count": 7412,
+ "key": "80"
+ },
+ {
+ "count": 1091,
+ "key": "2096"
+ },
+ {
+ "count": 1021,
+ "key": "5985"
+ },
+ {
+ "count": 985,
+ "key": "135"
+ },
+ {
+ "count": 842,
+ "key": "445"
+ },
+ {
+ "count": 797,
+ "key": "53"
+ },
+ {
+ "count": 786,
+ "key": "8443"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 20519,
+ "query_duration_millis": 125,
+ "total_count": 25654
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 14570,
+ "key": "openssh"
+ },
+ {
+ "count": 10034,
+ "key": "nginx"
+ },
+ {
+ "count": 2567,
+ "key": "express"
+ },
+ {
+ "count": 1582,
+ "key": "http_server"
+ },
+ {
+ "count": 1224,
+ "key": "dovecot"
+ },
+ {
+ "count": 1124,
+ "key": "http_api"
+ },
+ {
+ "count": 859,
+ "key": "google_web_services"
+ },
+ {
+ "count": 804,
+ "key": "web_server"
+ },
+ {
+ "count": 705,
+ "key": "caddy"
+ },
+ {
+ "count": 666,
+ "key": "jquery"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 16007,
+ "query_duration_millis": 91,
+ "total_count": 25654
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 25654,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 210,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 22,
+ "total_count": 25654
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2029,
+ "key": "YE2"
+ },
+ {
+ "count": 1907,
+ "key": "YE1"
+ },
+ {
+ "count": 995,
+ "key": "windows-Dallas0"
+ },
+ {
+ "count": 977,
+ "key": "YR1"
+ },
+ {
+ "count": 967,
+ "key": "YR2"
+ },
+ {
+ "count": 870,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 429,
+ "key": "windows-Utah-4g"
+ },
+ {
+ "count": 378,
+ "key": "www.example.com"
+ },
+ {
+ "count": 373,
+ "key": "windows-Amsterd"
+ },
+ {
+ "count": 343,
+ "key": "TRAEFIK DEFAULT CERT"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 13042,
+ "query_duration_millis": 160,
+ "total_count": 25654
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 13776,
+ "key": "linux"
+ },
+ {
+ "count": 5506,
+ "key": "windows"
+ },
+ {
+ "count": 218,
+ "key": "ubuntu"
+ },
+ {
+ "count": 135,
+ "key": "debian_linux"
+ },
+ {
+ "count": 101,
+ "key": "routeros"
+ },
+ {
+ "count": 30,
+ "key": "freebsd"
+ },
+ {
+ "count": 21,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 21,
+ "key": "windows_server"
+ },
+ {
+ "count": 9,
+ "key": "proxmox"
+ },
+ {
+ "count": 8,
+ "key": "adaptive_security_appliance_software"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 20,
+ "query_duration_millis": 126,
+ "total_count": 25654
+ }
+ }
+ }
+ },
+ "AS216139": {
+ "name": "IRONHOST",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5492,
+ "key": "22"
+ },
+ {
+ "count": 3315,
+ "key": "443"
+ },
+ {
+ "count": 2125,
+ "key": "80"
+ },
+ {
+ "count": 946,
+ "key": "51821"
+ },
+ {
+ "count": 782,
+ "key": "53"
+ },
+ {
+ "count": 621,
+ "key": "21"
+ },
+ {
+ "count": 554,
+ "key": "2096"
+ },
+ {
+ "count": 464,
+ "key": "25"
+ },
+ {
+ "count": 425,
+ "key": "110"
+ },
+ {
+ "count": 410,
+ "key": "143"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 8904,
+ "query_duration_millis": 46,
+ "total_count": 9100
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4460,
+ "key": "openssh"
+ },
+ {
+ "count": 2997,
+ "key": "nginx"
+ },
+ {
+ "count": 1354,
+ "key": "dovecot"
+ },
+ {
+ "count": 1069,
+ "key": "ddos-guard"
+ },
+ {
+ "count": 933,
+ "key": "wg-easy"
+ },
+ {
+ "count": 836,
+ "key": "exim"
+ },
+ {
+ "count": 783,
+ "key": "express"
+ },
+ {
+ "count": 625,
+ "key": "google_web_services"
+ },
+ {
+ "count": 623,
+ "key": "web_server"
+ },
+ {
+ "count": 399,
+ "key": "bind"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 5971,
+ "query_duration_millis": 277,
+ "total_count": 9100
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 9100,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 4,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 52,
+ "total_count": 9100
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 701,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 634,
+ "key": "YE1"
+ },
+ {
+ "count": 604,
+ "key": "YE2"
+ },
+ {
+ "count": 404,
+ "key": "GlobalSign GCC R6 AlphaSSL CA 2025"
+ },
+ {
+ "count": 231,
+ "key": "YR2"
+ },
+ {
+ "count": 220,
+ "key": "YR1"
+ },
+ {
+ "count": 203,
+ "key": "WE1"
+ },
+ {
+ "count": 189,
+ "key": "idrac"
+ },
+ {
+ "count": 179,
+ "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate"
+ },
+ {
+ "count": 177,
+ "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3551,
+ "query_duration_millis": 173,
+ "total_count": 9100
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3886,
+ "key": "linux"
+ },
+ {
+ "count": 184,
+ "key": "ubuntu"
+ },
+ {
+ "count": 55,
+ "key": "enterprise_linux"
+ },
+ {
+ "count": 53,
+ "key": "routeros"
+ },
+ {
+ "count": 32,
+ "key": "debian_linux"
+ },
+ {
+ "count": 26,
+ "key": "centos"
+ },
+ {
+ "count": 16,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 4,
+ "key": "freebsd"
+ },
+ {
+ "count": 3,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "linux_ami"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1,
+ "query_duration_millis": 1440,
+ "total_count": 9100
+ }
+ }
+ }
+ },
+ "AS51852": {
+ "name": "PLI-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4338,
+ "key": "443"
+ },
+ {
+ "count": 4060,
+ "key": "22"
+ },
+ {
+ "count": 3590,
+ "key": "161"
+ },
+ {
+ "count": 2799,
+ "key": "80"
+ },
+ {
+ "count": 1886,
+ "key": "123"
+ },
+ {
+ "count": 1547,
+ "key": "53"
+ },
+ {
+ "count": 829,
+ "key": "25"
+ },
+ {
+ "count": 829,
+ "key": "500"
+ },
+ {
+ "count": 798,
+ "key": "21"
+ },
+ {
+ "count": 796,
+ "key": "143"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 15977,
+ "query_duration_millis": 966,
+ "total_count": 8641
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4731,
+ "key": "nginx"
+ },
+ {
+ "count": 4036,
+ "key": "openssh"
+ },
+ {
+ "count": 2536,
+ "key": "dovecot"
+ },
+ {
+ "count": 1391,
+ "key": "exim"
+ },
+ {
+ "count": 819,
+ "key": "openvpn_access_server"
+ },
+ {
+ "count": 816,
+ "key": "cpanel"
+ },
+ {
+ "count": 753,
+ "key": "bind"
+ },
+ {
+ "count": 740,
+ "key": "http_server"
+ },
+ {
+ "count": 598,
+ "key": "ceph"
+ },
+ {
+ "count": 512,
+ "key": "webmail"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 8305,
+ "query_duration_millis": 143,
+ "total_count": 8641
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 8641,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 39,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 131,
+ "total_count": 8641
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1906,
+ "key": "server"
+ },
+ {
+ "count": 1451,
+ "key": "YR2"
+ },
+ {
+ "count": 962,
+ "key": "YR1"
+ },
+ {
+ "count": 903,
+ "key": "Hydra Authentication RSA SubCA #155"
+ },
+ {
+ "count": 804,
+ "key": "server.domain.com"
+ },
+ {
+ "count": 534,
+ "key": "YE2"
+ },
+ {
+ "count": 405,
+ "key": "YE1"
+ },
+ {
+ "count": 348,
+ "key": "server.ibras.eu"
+ },
+ {
+ "count": 295,
+ "key": "''"
+ },
+ {
+ "count": 263,
+ "key": "invalid2.invalid"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4001,
+ "query_duration_millis": 132,
+ "total_count": 8641
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3029,
+ "key": "linux"
+ },
+ {
+ "count": 208,
+ "key": "windows"
+ },
+ {
+ "count": 157,
+ "key": "proxmox"
+ },
+ {
+ "count": 129,
+ "key": "enterprise_linux"
+ },
+ {
+ "count": 47,
+ "key": "ubuntu"
+ },
+ {
+ "count": 36,
+ "key": "debian_linux"
+ },
+ {
+ "count": 32,
+ "key": "freebsd"
+ },
+ {
+ "count": 26,
+ "key": "centos"
+ },
+ {
+ "count": 22,
+ "key": "routeros"
+ },
+ {
+ "count": 17,
+ "key": "vmware_esxi_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 21,
+ "query_duration_millis": 177,
+ "total_count": 8641
+ }
+ }
+ }
+ },
+ "AS400992": {
+ "name": "ZHOUYISAT-COMMUNICATIONS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6669,
+ "key": "22"
+ },
+ {
+ "count": 3214,
+ "key": "443"
+ },
+ {
+ "count": 1298,
+ "key": "80"
+ },
+ {
+ "count": 1045,
+ "key": "2096"
+ },
+ {
+ "count": 494,
+ "key": "8443"
+ },
+ {
+ "count": 193,
+ "key": "2222"
+ },
+ {
+ "count": 192,
+ "key": "8080"
+ },
+ {
+ "count": 183,
+ "key": "3389"
+ },
+ {
+ "count": 174,
+ "key": "2053"
+ },
+ {
+ "count": 121,
+ "key": "25"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4258,
+ "query_duration_millis": 61,
+ "total_count": 7781
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5750,
+ "key": "openssh"
+ },
+ {
+ "count": 1959,
+ "key": "nginx"
+ },
+ {
+ "count": 909,
+ "key": "google_web_services"
+ },
+ {
+ "count": 906,
+ "key": "web_server"
+ },
+ {
+ "count": 434,
+ "key": "app_and_api_protector"
+ },
+ {
+ "count": 434,
+ "key": "ghost"
+ },
+ {
+ "count": 321,
+ "key": "waf"
+ },
+ {
+ "count": 306,
+ "key": "cloudflare_load_balancer"
+ },
+ {
+ "count": 266,
+ "key": "caddy"
+ },
+ {
+ "count": 237,
+ "key": "express"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2595,
+ "query_duration_millis": 179,
+ "total_count": 7781
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7781,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 41,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 41,
+ "total_count": 7781
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 998,
+ "key": "YE2"
+ },
+ {
+ "count": 908,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 877,
+ "key": "YE1"
+ },
+ {
+ "count": 253,
+ "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"
+ },
+ {
+ "count": 244,
+ "key": "YR2"
+ },
+ {
+ "count": 198,
+ "key": "WE1"
+ },
+ {
+ "count": 191,
+ "key": "YR1"
+ },
+ {
+ "count": 136,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 105,
+ "key": "GlobalSign ECC OV SSL CA 2018"
+ },
+ {
+ "count": 100,
+ "key": "Sectigo Public Server Authentication CA DV E36"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2008,
+ "query_duration_millis": 122,
+ "total_count": 7781
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5522,
+ "key": "linux"
+ },
+ {
+ "count": 63,
+ "key": "ubuntu"
+ },
+ {
+ "count": 44,
+ "key": "windows"
+ },
+ {
+ "count": 26,
+ "key": "debian_linux"
+ },
+ {
+ "count": 17,
+ "key": "routeros"
+ },
+ {
+ "count": 9,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 5,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 2,
+ "key": "centos"
+ },
+ {
+ "count": 2,
+ "key": "freebsd"
+ },
+ {
+ "count": 1,
+ "key": "linux_ami"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1,
+ "query_duration_millis": 28,
+ "total_count": 7781
+ }
+ }
+ }
+ },
+ "AS33993": {
+ "name": "UFO-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3135,
+ "key": "22"
+ },
+ {
+ "count": 2062,
+ "key": "443"
+ },
+ {
+ "count": 2022,
+ "key": "80"
+ },
+ {
+ "count": 1411,
+ "key": "53"
+ },
+ {
+ "count": 713,
+ "key": "21"
+ },
+ {
+ "count": 601,
+ "key": "3000"
+ },
+ {
+ "count": 555,
+ "key": "1500"
+ },
+ {
+ "count": 548,
+ "key": "25"
+ },
+ {
+ "count": 523,
+ "key": "993"
+ },
+ {
+ "count": 512,
+ "key": "143"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 9561,
+ "query_duration_millis": 362,
+ "total_count": 4842
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3759,
+ "key": "nginx"
+ },
+ {
+ "count": 3248,
+ "key": "openssh"
+ },
+ {
+ "count": 1719,
+ "key": "dovecot"
+ },
+ {
+ "count": 1155,
+ "key": "exim"
+ },
+ {
+ "count": 1141,
+ "key": "bind"
+ },
+ {
+ "count": 570,
+ "key": "proftpd"
+ },
+ {
+ "count": 384,
+ "key": "express"
+ },
+ {
+ "count": 290,
+ "key": "python"
+ },
+ {
+ "count": 230,
+ "key": "aiohttp"
+ },
+ {
+ "count": 228,
+ "key": "bootstrap"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3414,
+ "query_duration_millis": 42,
+ "total_count": 4842
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4842,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 9,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 50,
+ "total_count": 4842
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 769,
+ "key": "YR2"
+ },
+ {
+ "count": 715,
+ "key": "YR1"
+ },
+ {
+ "count": 516,
+ "key": "YE2"
+ },
+ {
+ "count": 487,
+ "key": "YE1"
+ },
+ {
+ "count": 322,
+ "key": "ssl.by"
+ },
+ {
+ "count": 242,
+ "key": "Sectigo Public Server Authentication CA DV E36"
+ },
+ {
+ "count": 173,
+ "key": "issssrt.ru"
+ },
+ {
+ "count": 124,
+ "key": "GlobalSign GCC R3 DV TLS CA 2020"
+ },
+ {
+ "count": 113,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 105,
+ "key": "TRAEFIK DEFAULT CERT"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4885,
+ "query_duration_millis": 107,
+ "total_count": 4842
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2989,
+ "key": "linux"
+ },
+ {
+ "count": 132,
+ "key": "ubuntu"
+ },
+ {
+ "count": 57,
+ "key": "windows"
+ },
+ {
+ "count": 38,
+ "key": "enterprise_linux"
+ },
+ {
+ "count": 23,
+ "key": "debian_linux"
+ },
+ {
+ "count": 21,
+ "key": "routeros"
+ },
+ {
+ "count": 6,
+ "key": "freebsd"
+ },
+ {
+ "count": 5,
+ "key": "centos"
+ },
+ {
+ "count": 4,
+ "key": "windows_server"
+ },
+ {
+ "count": 3,
+ "key": "linux_kernel"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 5,
+ "query_duration_millis": 335,
+ "total_count": 4842
+ }
+ }
+ }
+ },
+ "AS51396": {
+ "name": "PFCLOUD (Pfcloud UG)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 838,
+ "key": "22"
+ },
+ {
+ "count": 360,
+ "key": "80"
+ },
+ {
+ "count": 281,
+ "key": "443"
+ },
+ {
+ "count": 129,
+ "key": "3389"
+ },
+ {
+ "count": 100,
+ "key": "1407"
+ },
+ {
+ "count": 99,
+ "key": "11407"
+ },
+ {
+ "count": 94,
+ "key": "135"
+ },
+ {
+ "count": 93,
+ "key": "445"
+ },
+ {
+ "count": 87,
+ "key": "5985"
+ },
+ {
+ "count": 84,
+ "key": "139"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3342,
+ "query_duration_millis": 457,
+ "total_count": 1917
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 744,
+ "key": "openssh"
+ },
+ {
+ "count": 398,
+ "key": "nginx"
+ },
+ {
+ "count": 191,
+ "key": "http_server"
+ },
+ {
+ "count": 129,
+ "key": "http_api"
+ },
+ {
+ "count": 105,
+ "key": "express"
+ },
+ {
+ "count": 69,
+ "key": "php"
+ },
+ {
+ "count": 53,
+ "key": "python"
+ },
+ {
+ "count": 48,
+ "key": "jquery"
+ },
+ {
+ "count": 48,
+ "key": "pve"
+ },
+ {
+ "count": 48,
+ "key": "virtual_environment"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 801,
+ "query_duration_millis": 1064,
+ "total_count": 1917
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1917,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 15,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 159,
+ "total_count": 1917
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 110,
+ "key": "YE1"
+ },
+ {
+ "count": 105,
+ "key": "YE2"
+ },
+ {
+ "count": 45,
+ "key": "YR2"
+ },
+ {
+ "count": 42,
+ "key": "YR1"
+ },
+ {
+ "count": 27,
+ "key": "WIN-9QL4SDRB93L"
+ },
+ {
+ "count": 24,
+ "key": "localhost"
+ },
+ {
+ "count": 20,
+ "key": "Proxmox Virtual Environment"
+ },
+ {
+ "count": 20,
+ "key": "TRAEFIK DEFAULT CERT"
+ },
+ {
+ "count": 20,
+ "key": "WIN-IK7N6SD2UBU"
+ },
+ {
+ "count": 17,
+ "key": "invalid2.invalid"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 440,
+ "query_duration_millis": 126,
+ "total_count": 1917
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 668,
+ "key": "linux"
+ },
+ {
+ "count": 85,
+ "key": "windows"
+ },
+ {
+ "count": 39,
+ "key": "debian_linux"
+ },
+ {
+ "count": 22,
+ "key": "proxmox"
+ },
+ {
+ "count": 13,
+ "key": "ubuntu"
+ },
+ {
+ "count": 3,
+ "key": "centos"
+ },
+ {
+ "count": 3,
+ "key": "routeros"
+ },
+ {
+ "count": 1,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "windows_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 72,
+ "total_count": 1917
+ }
+ }
+ }
+ },
+ "AS213702": {
+ "name": "QWINS-LTD",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6376,
+ "key": "22"
+ },
+ {
+ "count": 4393,
+ "key": "443"
+ },
+ {
+ "count": 2150,
+ "key": "80"
+ },
+ {
+ "count": 2020,
+ "key": "2222"
+ },
+ {
+ "count": 820,
+ "key": "8443"
+ },
+ {
+ "count": 671,
+ "key": "2096"
+ },
+ {
+ "count": 404,
+ "key": "3389"
+ },
+ {
+ "count": 242,
+ "key": "8080"
+ },
+ {
+ "count": 193,
+ "key": "2053"
+ },
+ {
+ "count": 160,
+ "key": "9443"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4685,
+ "query_duration_millis": 3206,
+ "total_count": 7381
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6147,
+ "key": "openssh"
+ },
+ {
+ "count": 3386,
+ "key": "nginx"
+ },
+ {
+ "count": 621,
+ "key": "caddy"
+ },
+ {
+ "count": 522,
+ "key": "google_web_services"
+ },
+ {
+ "count": 521,
+ "key": "web_server"
+ },
+ {
+ "count": 472,
+ "key": "app_and_api_protector"
+ },
+ {
+ "count": 472,
+ "key": "ghost"
+ },
+ {
+ "count": 333,
+ "key": "express"
+ },
+ {
+ "count": 266,
+ "key": "waf"
+ },
+ {
+ "count": 254,
+ "key": "cloudflare_load_balancer"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2854,
+ "query_duration_millis": 37,
+ "total_count": 7381
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7381,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 16,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 27,
+ "total_count": 7381
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1187,
+ "key": "YE2"
+ },
+ {
+ "count": 1098,
+ "key": "YE1"
+ },
+ {
+ "count": 768,
+ "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo"
+ },
+ {
+ "count": 524,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 331,
+ "key": "YR2"
+ },
+ {
+ "count": 234,
+ "key": "YR1"
+ },
+ {
+ "count": 217,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 193,
+ "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5"
+ },
+ {
+ "count": 185,
+ "key": "NvJhHp68p5mjSuW_EK9Lab6bH9"
+ },
+ {
+ "count": 169,
+ "key": "WE1"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3494,
+ "query_duration_millis": 144,
+ "total_count": 7381
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6029,
+ "key": "linux"
+ },
+ {
+ "count": 98,
+ "key": "windows"
+ },
+ {
+ "count": 63,
+ "key": "ubuntu"
+ },
+ {
+ "count": 14,
+ "key": "debian_linux"
+ },
+ {
+ "count": 10,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "enterprise_linux"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 49,
+ "total_count": 7381
+ }
+ }
+ }
+ },
+ "AS216246": {
+ "name": "RU-AEZA-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5672,
+ "key": "22"
+ },
+ {
+ "count": 4259,
+ "key": "443"
+ },
+ {
+ "count": 3282,
+ "key": "80"
+ },
+ {
+ "count": 704,
+ "key": "2096"
+ },
+ {
+ "count": 693,
+ "key": "8443"
+ },
+ {
+ "count": 390,
+ "key": "8080"
+ },
+ {
+ "count": 368,
+ "key": "2222"
+ },
+ {
+ "count": 310,
+ "key": "3389"
+ },
+ {
+ "count": 193,
+ "key": "3000"
+ },
+ {
+ "count": 179,
+ "key": "3478"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 5444,
+ "query_duration_millis": 519,
+ "total_count": 7024
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5230,
+ "key": "openssh"
+ },
+ {
+ "count": 5040,
+ "key": "nginx"
+ },
+ {
+ "count": 642,
+ "key": "caddy"
+ },
+ {
+ "count": 501,
+ "key": "express"
+ },
+ {
+ "count": 284,
+ "key": "dovecot"
+ },
+ {
+ "count": 261,
+ "key": "ghost"
+ },
+ {
+ "count": 260,
+ "key": "app_and_api_protector"
+ },
+ {
+ "count": 238,
+ "key": "traefik_proxy"
+ },
+ {
+ "count": 232,
+ "key": "next.js"
+ },
+ {
+ "count": 221,
+ "key": "next\\.js"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3954,
+ "query_duration_millis": 92,
+ "total_count": 7024
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7024,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 136,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 112,
+ "total_count": 7024
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1388,
+ "key": "YE1"
+ },
+ {
+ "count": 1307,
+ "key": "YE2"
+ },
+ {
+ "count": 349,
+ "key": "YR2"
+ },
+ {
+ "count": 275,
+ "key": "YR1"
+ },
+ {
+ "count": 273,
+ "key": "GlobalSign ECC OV SSL CA 2018"
+ },
+ {
+ "count": 239,
+ "key": "TRAEFIK DEFAULT CERT"
+ },
+ {
+ "count": 202,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 155,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 119,
+ "key": "WE1"
+ },
+ {
+ "count": 113,
+ "key": "WR1"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2483,
+ "query_duration_millis": 186,
+ "total_count": 7024
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5090,
+ "key": "linux"
+ },
+ {
+ "count": 220,
+ "key": "ubuntu"
+ },
+ {
+ "count": 135,
+ "key": "windows"
+ },
+ {
+ "count": 30,
+ "key": "debian_linux"
+ },
+ {
+ "count": 10,
+ "key": "routeros"
+ },
+ {
+ "count": 7,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 3,
+ "key": "proxmox"
+ },
+ {
+ "count": 2,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 2,
+ "key": "windows_server"
+ },
+ {
+ "count": 1,
+ "key": "centos"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2,
+ "query_duration_millis": 152,
+ "total_count": 7024
+ }
+ }
+ }
+ },
+ "AS200651": {
+ "name": "FLOKINET",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2841,
+ "key": "22"
+ },
+ {
+ "count": 2118,
+ "key": "443"
+ },
+ {
+ "count": 1917,
+ "key": "80"
+ },
+ {
+ "count": 380,
+ "key": "53"
+ },
+ {
+ "count": 282,
+ "key": "25"
+ },
+ {
+ "count": 234,
+ "key": "587"
+ },
+ {
+ "count": 222,
+ "key": "993"
+ },
+ {
+ "count": 189,
+ "key": "111"
+ },
+ {
+ "count": 186,
+ "key": "143"
+ },
+ {
+ "count": 168,
+ "key": "110"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4831,
+ "query_duration_millis": 180,
+ "total_count": 3806
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2825,
+ "key": "nginx"
+ },
+ {
+ "count": 2589,
+ "key": "openssh"
+ },
+ {
+ "count": 585,
+ "key": "dovecot"
+ },
+ {
+ "count": 465,
+ "key": "http_server"
+ },
+ {
+ "count": 361,
+ "key": "cpanel"
+ },
+ {
+ "count": 303,
+ "key": "express"
+ },
+ {
+ "count": 270,
+ "key": "exim"
+ },
+ {
+ "count": 258,
+ "key": "caddy"
+ },
+ {
+ "count": 247,
+ "key": "openresty"
+ },
+ {
+ "count": 196,
+ "key": "authoritative_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 3469,
+ "query_duration_millis": 79,
+ "total_count": 3806
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3806,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 130,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 20,
+ "total_count": 3806
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 725,
+ "key": "YE1"
+ },
+ {
+ "count": 637,
+ "key": "YR2"
+ },
+ {
+ "count": 612,
+ "key": "YE2"
+ },
+ {
+ "count": 562,
+ "key": "YR1"
+ },
+ {
+ "count": 131,
+ "key": "TRAEFIK DEFAULT CERT"
+ },
+ {
+ "count": 99,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 59,
+ "key": "localhost"
+ },
+ {
+ "count": 47,
+ "key": "WE1"
+ },
+ {
+ "count": 40,
+ "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3"
+ },
+ {
+ "count": 40,
+ "key": "www.example.com"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1621,
+ "query_duration_millis": 128,
+ "total_count": 3806
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2167,
+ "key": "linux"
+ },
+ {
+ "count": 56,
+ "key": "ubuntu"
+ },
+ {
+ "count": 48,
+ "key": "debian_linux"
+ },
+ {
+ "count": 30,
+ "key": "proxmox"
+ },
+ {
+ "count": 27,
+ "key": "windows"
+ },
+ {
+ "count": 10,
+ "key": "freebsd"
+ },
+ {
+ "count": 8,
+ "key": "routeros"
+ },
+ {
+ "count": 6,
+ "key": "enterprise_linux"
+ },
+ {
+ "count": 6,
+ "key": "openbsd"
+ },
+ {
+ "count": 5,
+ "key": "centos"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 8,
+ "query_duration_millis": 162,
+ "total_count": 3806
+ }
+ }
+ }
+ },
+ "AS30823": {
+ "name": "AUROLOGIC (aurologic GmbH)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1203,
+ "key": "22"
+ },
+ {
+ "count": 808,
+ "key": "443"
+ },
+ {
+ "count": 614,
+ "key": "80"
+ },
+ {
+ "count": 457,
+ "key": "53"
+ },
+ {
+ "count": 388,
+ "key": "27015"
+ },
+ {
+ "count": 296,
+ "key": "3389"
+ },
+ {
+ "count": 109,
+ "key": "25"
+ },
+ {
+ "count": 109,
+ "key": "8443"
+ },
+ {
+ "count": 95,
+ "key": "2096"
+ },
+ {
+ "count": 84,
+ "key": "8080"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2409,
+ "query_duration_millis": 98,
+ "total_count": 2036
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1113,
+ "key": "openssh"
+ },
+ {
+ "count": 776,
+ "key": "nginx"
+ },
+ {
+ "count": 198,
+ "key": "express"
+ },
+ {
+ "count": 137,
+ "key": "http_server"
+ },
+ {
+ "count": 102,
+ "key": "google_web_services"
+ },
+ {
+ "count": 102,
+ "key": "web_server"
+ },
+ {
+ "count": 92,
+ "key": "dovecot"
+ },
+ {
+ "count": 92,
+ "key": "http_api"
+ },
+ {
+ "count": 69,
+ "key": "caddy"
+ },
+ {
+ "count": 66,
+ "key": "cloudflare_load_balancer"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1549,
+ "query_duration_millis": 144,
+ "total_count": 2036
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2036,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 28,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 421,
+ "total_count": 2036
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 201,
+ "key": "YE2"
+ },
+ {
+ "count": 198,
+ "key": "YE1"
+ },
+ {
+ "count": 108,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 97,
+ "key": "YR2"
+ },
+ {
+ "count": 92,
+ "key": "YR1"
+ },
+ {
+ "count": 62,
+ "key": "windows-DE-Fran"
+ },
+ {
+ "count": 58,
+ "key": "172.86.93"
+ },
+ {
+ "count": 56,
+ "key": "windows-Frankfu"
+ },
+ {
+ "count": 51,
+ "key": "GoGetSSL RSA DV CA"
+ },
+ {
+ "count": 36,
+ "key": "WE1"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 986,
+ "query_duration_millis": 184,
+ "total_count": 2036
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1025,
+ "key": "linux"
+ },
+ {
+ "count": 162,
+ "key": "windows"
+ },
+ {
+ "count": 21,
+ "key": "proxmox"
+ },
+ {
+ "count": 17,
+ "key": "routeros"
+ },
+ {
+ "count": 15,
+ "key": "debian_linux"
+ },
+ {
+ "count": 11,
+ "key": "ubuntu"
+ },
+ {
+ "count": 9,
+ "key": "centos"
+ },
+ {
+ "count": 6,
+ "key": "freebsd"
+ },
+ {
+ "count": 4,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 3,
+ "key": "megarac_spx"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 6,
+ "query_duration_millis": 338,
+ "total_count": 2036
+ }
+ }
+ }
+ },
+ "AS140666": {
+ "name": "ADPL-AS-AP (ANY DIGITAL PTE. LTD.)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1652,
+ "key": "22"
+ },
+ {
+ "count": 694,
+ "key": "443"
+ },
+ {
+ "count": 535,
+ "key": "80"
+ },
+ {
+ "count": 376,
+ "key": "6004"
+ },
+ {
+ "count": 376,
+ "key": "6011"
+ },
+ {
+ "count": 375,
+ "key": "6001"
+ },
+ {
+ "count": 375,
+ "key": "6006"
+ },
+ {
+ "count": 375,
+ "key": "6007"
+ },
+ {
+ "count": 375,
+ "key": "6010"
+ },
+ {
+ "count": 375,
+ "key": "6012"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 12271,
+ "query_duration_millis": 32,
+ "total_count": 2805
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1615,
+ "key": "openssh"
+ },
+ {
+ "count": 1378,
+ "key": "nginx"
+ },
+ {
+ "count": 146,
+ "key": "openresty"
+ },
+ {
+ "count": 131,
+ "key": "http_api"
+ },
+ {
+ "count": 80,
+ "key": "jquery"
+ },
+ {
+ "count": 74,
+ "key": "internet_information_services"
+ },
+ {
+ "count": 58,
+ "key": "tengine"
+ },
+ {
+ "count": 54,
+ "key": "bootstrap"
+ },
+ {
+ "count": 39,
+ "key": "express"
+ },
+ {
+ "count": 36,
+ "key": "node_exporter"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 575,
+ "query_duration_millis": 168,
+ "total_count": 2805
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2805,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 244,
+ "total_count": 2805
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 338,
+ "key": "Sectigo Public Server Authentication CA DV R36"
+ },
+ {
+ "count": 183,
+ "key": "NONE"
+ },
+ {
+ "count": 135,
+ "key": "RapidSSL TLS RSA CA G1"
+ },
+ {
+ "count": 109,
+ "key": "tudog_node_agent._reserved.bytefcdn.com"
+ },
+ {
+ "count": 107,
+ "key": "RTCTS"
+ },
+ {
+ "count": 102,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 92,
+ "key": "QY"
+ },
+ {
+ "count": 65,
+ "key": "RapidSSL TLS ECC CA G1"
+ },
+ {
+ "count": 60,
+ "key": "tls.internal.ypc.org"
+ },
+ {
+ "count": 47,
+ "key": "GlobalSign GCC R3 OV TLS CA 2024"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 717,
+ "query_duration_millis": 67,
+ "total_count": 2805
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1089,
+ "key": "linux"
+ },
+ {
+ "count": 95,
+ "key": "windows"
+ },
+ {
+ "count": 13,
+ "key": "ubuntu"
+ },
+ {
+ "count": 3,
+ "key": "routeros"
+ },
+ {
+ "count": 2,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 2,
+ "key": "debian_linux"
+ },
+ {
+ "count": 1,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "proxmox"
+ },
+ {
+ "count": 1,
+ "key": "windows_server_2008_r2"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 20,
+ "total_count": 2805
+ }
+ }
+ }
+ },
+ "AS214351": {
+ "name": "FEMOIT",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 547,
+ "key": "80"
+ },
+ {
+ "count": 536,
+ "key": "22"
+ },
+ {
+ "count": 340,
+ "key": "443"
+ },
+ {
+ "count": 94,
+ "key": "21"
+ },
+ {
+ "count": 93,
+ "key": "53"
+ },
+ {
+ "count": 89,
+ "key": "25"
+ },
+ {
+ "count": 87,
+ "key": "8085"
+ },
+ {
+ "count": 86,
+ "key": "22509"
+ },
+ {
+ "count": 81,
+ "key": "143"
+ },
+ {
+ "count": 81,
+ "key": "993"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 1019,
+ "query_duration_millis": 291,
+ "total_count": 712
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 795,
+ "key": "nginx"
+ },
+ {
+ "count": 586,
+ "key": "openssh"
+ },
+ {
+ "count": 251,
+ "key": "express"
+ },
+ {
+ "count": 216,
+ "key": "dovecot"
+ },
+ {
+ "count": 149,
+ "key": "fastpanel"
+ },
+ {
+ "count": 147,
+ "key": "exim"
+ },
+ {
+ "count": 81,
+ "key": "http_server"
+ },
+ {
+ "count": 56,
+ "key": "proftpd"
+ },
+ {
+ "count": 37,
+ "key": "http_api"
+ },
+ {
+ "count": 37,
+ "key": "next.js"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 394,
+ "query_duration_millis": 40,
+ "total_count": 712
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 712,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 161,
+ "total_count": 712
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 97,
+ "key": "etc"
+ },
+ {
+ "count": 60,
+ "key": "YR2"
+ },
+ {
+ "count": 53,
+ "key": "vm4660.defhost.co"
+ },
+ {
+ "count": 51,
+ "key": "YR1"
+ },
+ {
+ "count": 39,
+ "key": "parking"
+ },
+ {
+ "count": 37,
+ "key": "FASTPANEL"
+ },
+ {
+ "count": 34,
+ "key": "YE2"
+ },
+ {
+ "count": 31,
+ "key": "misp.goodip"
+ },
+ {
+ "count": 27,
+ "key": "YE1"
+ },
+ {
+ "count": 15,
+ "key": "tech0.test"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 545,
+ "query_duration_millis": 153,
+ "total_count": 712
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 516,
+ "key": "linux"
+ },
+ {
+ "count": 33,
+ "key": "windows"
+ },
+ {
+ "count": 6,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 4,
+ "key": "ubuntu"
+ },
+ {
+ "count": 1,
+ "key": "centos"
+ },
+ {
+ "count": 1,
+ "key": "debian_linux"
+ },
+ {
+ "count": 1,
+ "key": "windows_server"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 162,
+ "total_count": 712
+ }
+ }
+ }
+ },
+ "AS198953": {
+ "name": "PROTON66",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 166,
+ "key": "3389"
+ },
+ {
+ "count": 161,
+ "key": "22"
+ },
+ {
+ "count": 89,
+ "key": "80"
+ },
+ {
+ "count": 83,
+ "key": "443"
+ },
+ {
+ "count": 52,
+ "key": "135"
+ },
+ {
+ "count": 41,
+ "key": "137"
+ },
+ {
+ "count": 39,
+ "key": "53"
+ },
+ {
+ "count": 36,
+ "key": "139"
+ },
+ {
+ "count": 35,
+ "key": "5985"
+ },
+ {
+ "count": 25,
+ "key": "21"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 374,
+ "query_duration_millis": 185,
+ "total_count": 360
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 128,
+ "key": "nginx"
+ },
+ {
+ "count": 123,
+ "key": "openssh"
+ },
+ {
+ "count": 63,
+ "key": "dovecot"
+ },
+ {
+ "count": 44,
+ "key": "http_api"
+ },
+ {
+ "count": 36,
+ "key": "express"
+ },
+ {
+ "count": 31,
+ "key": "http_server"
+ },
+ {
+ "count": 30,
+ "key": "fastpanel"
+ },
+ {
+ "count": 24,
+ "key": "exim"
+ },
+ {
+ "count": 22,
+ "key": "requirejs"
+ },
+ {
+ "count": 19,
+ "key": "parallels_plesk_panel"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 231,
+ "query_duration_millis": 146,
+ "total_count": 360
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 360,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 923,
+ "total_count": 360
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 23,
+ "key": "Plesk"
+ },
+ {
+ "count": 19,
+ "key": "YR1"
+ },
+ {
+ "count": 16,
+ "key": "etc"
+ },
+ {
+ "count": 11,
+ "key": "AnyDesk Client"
+ },
+ {
+ "count": 10,
+ "key": "localhost"
+ },
+ {
+ "count": 9,
+ "key": "R11"
+ },
+ {
+ "count": 9,
+ "key": "parking"
+ },
+ {
+ "count": 8,
+ "key": "R12"
+ },
+ {
+ "count": 8,
+ "key": "YR2"
+ },
+ {
+ "count": 8,
+ "key": "test"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 272,
+ "query_duration_millis": 147,
+ "total_count": 360
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 117,
+ "key": "linux"
+ },
+ {
+ "count": 41,
+ "key": "windows"
+ },
+ {
+ "count": 4,
+ "key": "ubuntu"
+ },
+ {
+ "count": 3,
+ "key": "debian_linux"
+ },
+ {
+ "count": 2,
+ "key": "proxmox"
+ },
+ {
+ "count": 1,
+ "key": "adaptive_security_appliance_software"
+ },
+ {
+ "count": 1,
+ "key": "freenas_firmware"
+ },
+ {
+ "count": 1,
+ "key": "ios"
+ },
+ {
+ "count": 1,
+ "key": "linux_kernel"
+ },
+ {
+ "count": 1,
+ "key": "routeros"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2,
+ "query_duration_millis": 25,
+ "total_count": 360
+ }
+ }
+ }
+ },
+ "AS200593": {
+ "name": "PROSPERO-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 201,
+ "key": "22"
+ },
+ {
+ "count": 133,
+ "key": "3389"
+ },
+ {
+ "count": 113,
+ "key": "80"
+ },
+ {
+ "count": 81,
+ "key": "443"
+ },
+ {
+ "count": 38,
+ "key": "53"
+ },
+ {
+ "count": 26,
+ "key": "135"
+ },
+ {
+ "count": 26,
+ "key": "5985"
+ },
+ {
+ "count": 23,
+ "key": "21"
+ },
+ {
+ "count": 21,
+ "key": "25"
+ },
+ {
+ "count": 20,
+ "key": "143"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 310,
+ "query_duration_millis": 245,
+ "total_count": 348
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 150,
+ "key": "nginx"
+ },
+ {
+ "count": 137,
+ "key": "openssh"
+ },
+ {
+ "count": 60,
+ "key": "dovecot"
+ },
+ {
+ "count": 35,
+ "key": "parallels_plesk_panel"
+ },
+ {
+ "count": 35,
+ "key": "prototype"
+ },
+ {
+ "count": 35,
+ "key": "requirejs"
+ },
+ {
+ "count": 33,
+ "key": "express"
+ },
+ {
+ "count": 30,
+ "key": "http_server"
+ },
+ {
+ "count": 29,
+ "key": "http_api"
+ },
+ {
+ "count": 24,
+ "key": "plesk"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 180,
+ "query_duration_millis": 32,
+ "total_count": 348
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 348,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 97,
+ "total_count": 348
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 42,
+ "key": "Plesk"
+ },
+ {
+ "count": 29,
+ "key": "YR1"
+ },
+ {
+ "count": 24,
+ "key": "YR2"
+ },
+ {
+ "count": 13,
+ "key": "YE1"
+ },
+ {
+ "count": 12,
+ "key": "R13"
+ },
+ {
+ "count": 9,
+ "key": "TRAEFIK DEFAULT CERT"
+ },
+ {
+ "count": 7,
+ "key": "DESKTOP-GKGI28A"
+ },
+ {
+ "count": 6,
+ "key": "R12"
+ },
+ {
+ "count": 6,
+ "key": "ckicksp-1.example.com"
+ },
+ {
+ "count": 6,
+ "key": "devin-coo-1.example.com"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 207,
+ "query_duration_millis": 183,
+ "total_count": 348
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 138,
+ "key": "linux"
+ },
+ {
+ "count": 26,
+ "key": "windows"
+ },
+ {
+ "count": 3,
+ "key": "proxmox"
+ },
+ {
+ "count": 2,
+ "key": "debian_linux"
+ },
+ {
+ "count": 1,
+ "key": "ubuntu"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 262,
+ "total_count": 348
+ }
+ }
+ }
+ },
+ "AS214940": {
+ "name": "KPRONET",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 118,
+ "total_count": 0
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 39,
+ "total_count": 0
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 1001,
+ "total_count": 0
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 126,
+ "total_count": 0
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 568,
+ "total_count": 0
+ }
+ }
+ }
+ },
+ "AS206728": {
+ "name": "MEDIALAND-AS",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 7,
+ "key": "443"
+ },
+ {
+ "count": 6,
+ "key": "80"
+ },
+ {
+ "count": 3,
+ "key": "53"
+ },
+ {
+ "count": 2,
+ "key": "22"
+ },
+ {
+ "count": 2,
+ "key": "445"
+ },
+ {
+ "count": 2,
+ "key": "5910"
+ },
+ {
+ "count": 2,
+ "key": "5934"
+ },
+ {
+ "count": 1,
+ "key": "135"
+ },
+ {
+ "count": 1,
+ "key": "139"
+ },
+ {
+ "count": 1,
+ "key": "500"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 7,
+ "query_duration_millis": 26,
+ "total_count": 20
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 5,
+ "key": "nginx"
+ },
+ {
+ "count": 4,
+ "key": "http_api"
+ },
+ {
+ "count": 2,
+ "key": "asp.net"
+ },
+ {
+ "count": 2,
+ "key": "asp\\.net"
+ },
+ {
+ "count": 2,
+ "key": "internet_information_services"
+ },
+ {
+ "count": 1,
+ "key": "moment"
+ },
+ {
+ "count": 1,
+ "key": "openssh"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 89,
+ "total_count": 20
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 20,
+ "key": "BULLETPROOF"
+ },
+ {
+ "count": 6,
+ "key": "IPV6"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 777,
+ "total_count": 20
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 1,
+ "key": "YE1"
+ },
+ {
+ "count": 1,
+ "key": "hotelsoft.cer"
+ },
+ {
+ "count": 1,
+ "key": "invalid2.invalid"
+ },
+ {
+ "count": 1,
+ "key": "v673"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 132,
+ "total_count": 20
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 6,
+ "key": "windows"
+ },
+ {
+ "count": 1,
+ "key": "linux"
+ },
+ {
+ "count": 1,
+ "key": "routeros"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 58,
+ "total_count": 20
+ }
+ }
+ }
+ },
+ "AS211720": {
+ "name": "Datashield, Inc.",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 28,
+ "key": "22"
+ },
+ {
+ "count": 19,
+ "key": "3389"
+ },
+ {
+ "count": 14,
+ "key": "179"
+ },
+ {
+ "count": 9,
+ "key": "80"
+ },
+ {
+ "count": 7,
+ "key": "443"
+ },
+ {
+ "count": 6,
+ "key": "111"
+ },
+ {
+ "count": 6,
+ "key": "5985"
+ },
+ {
+ "count": 4,
+ "key": "8081"
+ },
+ {
+ "count": 3,
+ "key": "8080"
+ },
+ {
+ "count": 2,
+ "key": "135"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 14,
+ "query_duration_millis": 260,
+ "total_count": 50
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 25,
+ "key": "openssh"
+ },
+ {
+ "count": 11,
+ "key": "nginx"
+ },
+ {
+ "count": 6,
+ "key": "http_api"
+ },
+ {
+ "count": 2,
+ "key": "mariadb"
+ },
+ {
+ "count": 2,
+ "key": "tor"
+ },
+ {
+ "count": 1,
+ "key": "caddy"
+ },
+ {
+ "count": 1,
+ "key": "dropbear_ssh"
+ },
+ {
+ "count": 1,
+ "key": "gunicorn"
+ },
+ {
+ "count": 1,
+ "key": "http_server"
+ },
+ {
+ "count": 1,
+ "key": "libupnp"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 2,
+ "query_duration_millis": 111,
+ "total_count": 50
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 50,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 80,
+ "total_count": 50
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3,
+ "key": "IPMI"
+ },
+ {
+ "count": 2,
+ "key": "FREE"
+ },
+ {
+ "count": 1,
+ "key": "WIN-JDCEOBUFJUS"
+ },
+ {
+ "count": 1,
+ "key": "WIN-JP7KUDECHOR"
+ },
+ {
+ "count": 1,
+ "key": "YE1"
+ },
+ {
+ "count": 1,
+ "key": "YE2"
+ },
+ {
+ "count": 1,
+ "key": "YR2"
+ },
+ {
+ "count": 1,
+ "key": "agent-ca@1757674441"
+ },
+ {
+ "count": 1,
+ "key": "agent-ca@1757925038"
+ },
+ {
+ "count": 1,
+ "key": "agent-ca@1759158944"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 16,
+ "query_duration_millis": 122,
+ "total_count": 50
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 10,
+ "key": "linux"
+ },
+ {
+ "count": 3,
+ "key": "windows"
+ },
+ {
+ "count": 1,
+ "key": "debian_linux"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 98,
+ "total_count": 50
+ }
+ }
+ }
+ },
+ "AS216309": {
+ "name": "INVISIONTECH-GROUP-SRL",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 35,
+ "key": "22"
+ },
+ {
+ "count": 13,
+ "key": "80"
+ },
+ {
+ "count": 8,
+ "key": "443"
+ },
+ {
+ "count": 4,
+ "key": "111"
+ },
+ {
+ "count": 2,
+ "key": "25"
+ },
+ {
+ "count": 2,
+ "key": "53"
+ },
+ {
+ "count": 2,
+ "key": "110"
+ },
+ {
+ "count": 2,
+ "key": "143"
+ },
+ {
+ "count": 2,
+ "key": "161"
+ },
+ {
+ "count": 2,
+ "key": "993"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 36,
+ "query_duration_millis": 24,
+ "total_count": 37
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 25,
+ "key": "openssh"
+ },
+ {
+ "count": 16,
+ "key": "nginx"
+ },
+ {
+ "count": 10,
+ "key": "http_server"
+ },
+ {
+ "count": 9,
+ "key": "express"
+ },
+ {
+ "count": 6,
+ "key": "bootstrap"
+ },
+ {
+ "count": 6,
+ "key": "dovecot"
+ },
+ {
+ "count": 6,
+ "key": "php"
+ },
+ {
+ "count": 5,
+ "key": "prototype"
+ },
+ {
+ "count": 4,
+ "key": "jquery"
+ },
+ {
+ "count": 4,
+ "key": "openssl"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 34,
+ "query_duration_millis": 198,
+ "total_count": 37
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 37,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 197,
+ "total_count": 37
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 9,
+ "key": "YR2"
+ },
+ {
+ "count": 4,
+ "key": "Plesk"
+ },
+ {
+ "count": 3,
+ "key": "YE2"
+ },
+ {
+ "count": 3,
+ "key": "YR1"
+ },
+ {
+ "count": 2,
+ "key": "pbx.invisiontech.eu"
+ },
+ {
+ "count": 1,
+ "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate"
+ },
+ {
+ "count": 1,
+ "key": "OpenWrt"
+ },
+ {
+ "count": 1,
+ "key": "YE1"
+ },
+ {
+ "count": 1,
+ "key": "www.jxb5pzqmff4pcbab.com"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 134,
+ "total_count": 37
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 12,
+ "key": "linux"
+ },
+ {
+ "count": 2,
+ "key": "debian_linux"
+ },
+ {
+ "count": 1,
+ "key": "centos"
+ },
+ {
+ "count": 1,
+ "key": "proxmox"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 49,
+ "total_count": 37
+ }
+ }
+ }
+ },
+ "AS58854": {
+ "name": "KAOPY (Kaopu Cloud)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 180,
+ "key": "8887"
+ },
+ {
+ "count": 177,
+ "key": "80"
+ },
+ {
+ "count": 163,
+ "key": "443"
+ },
+ {
+ "count": 116,
+ "key": "0"
+ },
+ {
+ "count": 82,
+ "key": "8081"
+ },
+ {
+ "count": 79,
+ "key": "8888"
+ },
+ {
+ "count": 78,
+ "key": "111"
+ },
+ {
+ "count": 74,
+ "key": "16257"
+ },
+ {
+ "count": 74,
+ "key": "16259"
+ },
+ {
+ "count": 72,
+ "key": "16258"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 4440,
+ "query_duration_millis": 120,
+ "total_count": 624
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1169,
+ "key": "mysql"
+ },
+ {
+ "count": 349,
+ "key": "nginx"
+ },
+ {
+ "count": 228,
+ "key": "python"
+ },
+ {
+ "count": 183,
+ "key": "wsgiserver"
+ },
+ {
+ "count": 163,
+ "key": "jquery"
+ },
+ {
+ "count": 152,
+ "key": "bootstrap"
+ },
+ {
+ "count": 103,
+ "key": "node_exporter"
+ },
+ {
+ "count": 79,
+ "key": "openssh"
+ },
+ {
+ "count": 78,
+ "key": "kestrel_web_server"
+ },
+ {
+ "count": 72,
+ "key": "cadvisor"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 279,
+ "query_duration_millis": 536,
+ "total_count": 624
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 624,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 102,
+ "total_count": 624
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 47,
+ "key": "GlobalSign RSA OV SSL CA 2018"
+ },
+ {
+ "count": 13,
+ "key": "TrustAsia DV TLS RSA CA 2025"
+ },
+ {
+ "count": 10,
+ "key": "FtpServer"
+ },
+ {
+ "count": 9,
+ "key": "YR1"
+ },
+ {
+ "count": 8,
+ "key": "RapidSSL TLS RSA CA G1"
+ },
+ {
+ "count": 6,
+ "key": "TrustAsia DV TLS RSA CA 2024"
+ },
+ {
+ "count": 5,
+ "key": "IPMI"
+ },
+ {
+ "count": 5,
+ "key": "WIN-RIK6D08VRRQ"
+ },
+ {
+ "count": 4,
+ "key": "Firecloud Root Client Certification Authority"
+ },
+ {
+ "count": 4,
+ "key": "Sectigo Public Server Authentication CA DV R36"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 78,
+ "query_duration_millis": 101,
+ "total_count": 624
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 33,
+ "key": "linux"
+ },
+ {
+ "count": 26,
+ "key": "windows"
+ },
+ {
+ "count": 13,
+ "key": "ubuntu"
+ },
+ {
+ "count": 2,
+ "key": "routeros"
+ },
+ {
+ "count": 1,
+ "key": "centos"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 411,
+ "total_count": 624
+ }
+ }
+ }
+ },
+ "AS202685": {
+ "name": "TR-ARKEL",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4,
+ "key": "80"
+ },
+ {
+ "count": 2,
+ "key": "443"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 484,
+ "total_count": 4
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4,
+ "key": "internet_information_services"
+ },
+ {
+ "count": 2,
+ "key": "asp.net"
+ },
+ {
+ "count": 2,
+ "key": "asp\\.net"
+ },
+ {
+ "count": 2,
+ "key": "http_api"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 154,
+ "total_count": 4
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 116,
+ "total_count": 4
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 1,
+ "key": "GeoTrust TLS RSA CA G1"
+ },
+ {
+ "count": 1,
+ "key": "YR1"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 155,
+ "total_count": 4
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4,
+ "key": "windows"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 120,
+ "total_count": 4
+ }
+ }
+ }
+ },
+ "AS394711": {
+ "name": "KORGRID (KorGrid LLC)",
+ "agg": {
+ "host.services.port": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2,
+ "key": "80"
+ },
+ {
+ "count": 2,
+ "key": "443"
+ },
+ {
+ "count": 1,
+ "key": "3389"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 272,
+ "total_count": 3
+ }
+ },
+ "host.services.software.product": {
+ "result": {
+ "buckets": [
+ {
+ "count": 4,
+ "key": "bootstrap"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 31,
+ "total_count": 3
+ }
+ },
+ "host.labels.value": {
+ "result": {
+ "buckets": [
+ {
+ "count": 3,
+ "key": "BULLETPROOF"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 25,
+ "total_count": 3
+ }
+ },
+ "host.services.cert.parsed.issuer.common_name": {
+ "result": {
+ "buckets": [
+ {
+ "count": 2,
+ "key": "vergeos.local.root"
+ },
+ {
+ "count": 1,
+ "key": "pcmrp-test"
+ }
+ ],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 113,
+ "total_count": 3
+ }
+ },
+ "host.operating_system.product": {
+ "result": {
+ "buckets": [],
+ "is_more_than_total_hits": false,
+ "other_count": 0,
+ "query_duration_millis": 158,
+ "total_count": 3
+ }
+ }
+ }
+ }
+} \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-07 12:38:21 +0000