From b6f4f2af55e81a459cb126da5ef972b9305cf67d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 24 Aug 2026 00:26:19 -0400 Subject: add: bph report iocs and daily drop helper --- kevlar/2026-08-23/censys/aggregations-AS198953.ndjson | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 kevlar/2026-08-23/censys/aggregations-AS198953.ndjson (limited to 'kevlar/2026-08-23/censys/aggregations-AS198953.ndjson') diff --git a/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson new file mode 100644 index 0000000..671b715 --- /dev/null +++ b/kevlar/2026-08-23/censys/aggregations-AS198953.ndjson @@ -0,0 +1,5 @@ +{"field": "host.services.port", "buckets": [{"count": 167, "key": "3389"}, {"count": 162, "key": "22"}, {"count": 90, "key": "80"}, {"count": 86, "key": "443"}, {"count": 53, "key": "135"}, {"count": 40, "key": "137"}, {"count": 39, "key": "53"}, {"count": 36, "key": "139"}, {"count": 36, "key": "5985"}, {"count": 26, "key": "47001"}, {"count": 24, "key": "21"}, {"count": 23, "key": "123"}, {"count": 22, "key": "25"}, {"count": 21, "key": "143"}, {"count": 21, "key": "993"}], "total_count": 362} +{"field": "host.services.software.product", "buckets": [{"count": 129, "key": "nginx"}, {"count": 128, "key": "openssh"}, {"count": 61, "key": "dovecot"}, {"count": 43, "key": "http_api"}, {"count": 33, "key": "express"}, {"count": 33, "key": "http_server"}, {"count": 31, "key": "fastpanel"}, {"count": 26, "key": "exim"}, {"count": 26, "key": "requirejs"}, {"count": 24, "key": "parallels_plesk_panel"}, {"count": 24, "key": "prototype"}, {"count": 17, "key": "proftpd"}], "total_count": 362} +{"field": "host.labels.value", "buckets": [{"count": 362, "key": "BULLETPROOF"}], "total_count": 362} +{"field": "host.services.cert.parsed.issuer.common_name", "buckets": [{"count": 22, "key": "Plesk"}, {"count": 19, "key": "etc"}, {"count": 18, "key": "YR1"}, {"count": 11, "key": "AnyDesk Client"}, {"count": 10, "key": "R11"}, {"count": 10, "key": "R12"}, {"count": 9, "key": "YR2"}, {"count": 9, "key": "localhost"}, {"count": 8, "key": "FASTPANEL"}, {"count": 8, "key": "parking"}], "total_count": 362, "note": "AnyDesk Client issuer CNs = remote-access tool certs on 11 hosts"} +{"field": "host.operating_system.product", "buckets": [{"count": 120, "key": "linux"}, {"count": 43, "key": "windows"}, {"count": 3, "key": "debian_linux"}, {"count": 3, "key": "proxmox"}], "total_count": 362} -- cgit v1.2.3