From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/censys/aggregations-all.json | 4907 ++++++++++++++++++++++++ 1 file changed, 4907 insertions(+) create mode 100644 kevlar/2026-08-31/censys/aggregations-all.json (limited to 'kevlar/2026-08-31/censys/aggregations-all.json') diff --git a/kevlar/2026-08-31/censys/aggregations-all.json b/kevlar/2026-08-31/censys/aggregations-all.json new file mode 100644 index 0000000..2280a60 --- /dev/null +++ b/kevlar/2026-08-31/censys/aggregations-all.json @@ -0,0 +1,4907 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 77135, + "key": "22" + }, + { + "count": 49750, + "key": "443" + }, + { + "count": 32331, + "key": "80" + }, + { + "count": 14629, + "key": "2096" + }, + { + "count": 8459, + "key": "8443" + }, + { + "count": 4010, + "key": "111" + }, + { + "count": 2912, + "key": "8080" + }, + { + "count": 2598, + "key": "2222" + }, + { + "count": 2515, + "key": "2053" + }, + { + "count": 2258, + "key": "53" + } + ], + "is_more_than_total_hits": false, + "other_count": 125759, + "query_duration_millis": 220, + "total_count": 101011 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 76785, + "key": "openssh" + }, + { + "count": 59721, + "key": "nginx" + }, + { + "count": 8938, + "key": "google_web_services" + }, + { + "count": 8936, + "key": "web_server" + }, + { + "count": 6500, + "key": "ghost" + }, + { + "count": 6499, + "key": "app_and_api_protector" + }, + { + "count": 5458, + "key": "express" + }, + { + "count": 3900, + "key": "caddy" + }, + { + "count": 3435, + "key": "waf" + }, + { + "count": 3313, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 57657, + "query_duration_millis": 372, + "total_count": 101011 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 101011, + "key": "BULLETPROOF" + }, + { + "count": 8, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 171, + "total_count": 101011 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 13508, + "key": "YE2" + }, + { + "count": 13247, + "key": "YE1" + }, + { + "count": 9044, + "key": "invalid2.invalid" + }, + { + "count": 4967, + "key": "YR1" + }, + { + "count": 4513, + "key": "YR2" + }, + { + "count": 2378, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2369, + "key": "WE1" + }, + { + "count": 2034, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 1748, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 1538, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + } + ], + "is_more_than_total_hits": false, + "other_count": 35502, + "query_duration_millis": 171, + "total_count": 101011 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 72754, + "key": "linux" + }, + { + "count": 800, + "key": "ubuntu" + }, + { + "count": 573, + "key": "windows" + }, + { + "count": 305, + "key": "routeros" + }, + { + "count": 273, + "key": "debian_linux" + }, + { + "count": 180, + "key": "proxmox" + }, + { + "count": 139, + "key": "linux_kernel" + }, + { + "count": 108, + "key": "adaptive_security_appliance_software" + }, + { + "count": 55, + "key": "freebsd" + }, + { + "count": 44, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 132, + "query_duration_millis": 61, + "total_count": 101011 + } + } + } + }, + "AS209847": { + "name": "THE", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 980, + "key": "22" + }, + { + "count": 564, + "key": "8080" + }, + { + "count": 517, + "key": "1030" + }, + { + "count": 517, + "key": "1050" + }, + { + "count": 514, + "key": "24442" + }, + { + "count": 499, + "key": "1235" + }, + { + "count": 494, + "key": "1234" + }, + { + "count": 440, + "key": "443" + }, + { + "count": 419, + "key": "53" + }, + { + "count": 387, + "key": "80" + } + ], + "is_more_than_total_hits": false, + "other_count": 2363, + "query_duration_millis": 111, + "total_count": 1784 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1567, + "key": "python" + }, + { + "count": 1554, + "key": "aiohttp" + }, + { + "count": 1231, + "key": "openssh" + }, + { + "count": 723, + "key": "nginx" + }, + { + "count": 367, + "key": "bind" + }, + { + "count": 312, + "key": "dovecot" + }, + { + "count": 217, + "key": "exim" + }, + { + "count": 201, + "key": "proftpd" + }, + { + "count": 130, + "key": "google_web_services" + }, + { + "count": 130, + "key": "web_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 737, + "query_duration_millis": 109, + "total_count": 1784 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 1784, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 190, + "total_count": 1784 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 221, + "key": "YR1" + }, + { + "count": 203, + "key": "YR2" + }, + { + "count": 132, + "key": "invalid2.invalid" + }, + { + "count": 121, + "key": "YE2" + }, + { + "count": 107, + "key": "YE1" + }, + { + "count": 30, + "key": "server" + }, + { + "count": 22, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 21, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 19, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 17, + "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3" + } + ], + "is_more_than_total_hits": false, + "other_count": 1073, + "query_duration_millis": 118, + "total_count": 1784 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1210, + "key": "linux" + }, + { + "count": 42, + "key": "ubuntu" + }, + { + "count": 14, + "key": "windows" + }, + { + "count": 5, + "key": "routeros" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 125, + "total_count": 1784 + } + } + } + }, + "AS210644": { + "name": "AEZA-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 62401, + "key": "22" + }, + { + "count": 35627, + "key": "443" + }, + { + "count": 18220, + "key": "80" + }, + { + "count": 12493, + "key": "2096" + }, + { + "count": 8314, + "key": "8443" + }, + { + "count": 6208, + "key": "8080" + }, + { + "count": 3499, + "key": "2053" + }, + { + "count": 1995, + "key": "2222" + }, + { + "count": 1737, + "key": "3389" + }, + { + "count": 1158, + "key": "53" + } + ], + "is_more_than_total_hits": false, + "other_count": 59626, + "query_duration_millis": 77, + "total_count": 72191 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 61805, + "key": "openssh" + }, + { + "count": 30153, + "key": "nginx" + }, + { + "count": 7299, + "key": "google_web_services" + }, + { + "count": 7299, + "key": "web_server" + }, + { + "count": 5523, + "key": "ghost" + }, + { + "count": 5521, + "key": "app_and_api_protector" + }, + { + "count": 4247, + "key": "express" + }, + { + "count": 3438, + "key": "caddy" + }, + { + "count": 3128, + "key": "waf" + }, + { + "count": 2926, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 34593, + "query_duration_millis": 158, + "total_count": 72191 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 72191, + "key": "BULLETPROOF" + }, + { + "count": 509, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 238, + "total_count": 72191 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 13117, + "key": "YE2" + }, + { + "count": 13008, + "key": "YE1" + }, + { + "count": 7385, + "key": "invalid2.invalid" + }, + { + "count": 5097, + "key": "YR2" + }, + { + "count": 3278, + "key": "YR1" + }, + { + "count": 2117, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2056, + "key": "WE1" + }, + { + "count": 1819, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1341, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1288, + "key": "GlobalSign ECC OV SSL CA 2018" + } + ], + "is_more_than_total_hits": false, + "other_count": 25046, + "query_duration_millis": 193, + "total_count": 72191 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 60420, + "key": "linux" + }, + { + "count": 719, + "key": "ubuntu" + }, + { + "count": 573, + "key": "windows" + }, + { + "count": 209, + "key": "debian_linux" + }, + { + "count": 84, + "key": "routeros" + }, + { + "count": 83, + "key": "linux_kernel" + }, + { + "count": 34, + "key": "adaptive_security_appliance_software" + }, + { + "count": 14, + "key": "linux_ami" + }, + { + "count": 13, + "key": "centos" + }, + { + "count": 12, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 16, + "query_duration_millis": 56, + "total_count": 72191 + } + } + } + }, + "AS138915": { + "name": "KAOPU-HK (Kaopu Cloud HK Limited)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 7319, + "key": "22" + }, + { + "count": 2669, + "key": "443" + }, + { + "count": 2501, + "key": "80" + }, + { + "count": 2430, + "key": "32080" + }, + { + "count": 2379, + "key": "43080" + }, + { + "count": 2243, + "key": "40003" + }, + { + "count": 2238, + "key": "40801" + }, + { + "count": 2235, + "key": "40803" + }, + { + "count": 2234, + "key": "40804" + }, + { + "count": 2229, + "key": "40810" + } + ], + "is_more_than_total_hits": false, + "other_count": 62162, + "query_duration_millis": 306, + "total_count": 13554 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 7679, + "key": "openssh" + }, + { + "count": 6327, + "key": "openresty" + }, + { + "count": 4526, + "key": "tengine" + }, + { + "count": 3369, + "key": "nginx" + }, + { + "count": 1055, + "key": "http_api" + }, + { + "count": 553, + "key": "http_server" + }, + { + "count": 435, + "key": "express" + }, + { + "count": 430, + "key": "jquery" + }, + { + "count": 309, + "key": "bootstrap" + }, + { + "count": 309, + "key": "openvpn_access_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 4900, + "query_duration_millis": 154, + "total_count": 13554 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 13554, + "key": "BULLETPROOF" + }, + { + "count": 99, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 470, + "total_count": 13554 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 4619, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 2393, + "key": "localhost" + }, + { + "count": 2346, + "key": "prod-vpn.example.com" + }, + { + "count": 2310, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 2240, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1206, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 431, + "key": "NONE" + }, + { + "count": 431, + "key": "WoTrus RSA DV SSL CA 2" + }, + { + "count": 361, + "key": "YR1" + }, + { + "count": 345, + "key": "WIN-9QFKHJ39QE9" + } + ], + "is_more_than_total_hits": false, + "other_count": 7531, + "query_duration_millis": 511, + "total_count": 13554 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6092, + "key": "linux" + }, + { + "count": 626, + "key": "windows" + }, + { + "count": 66, + "key": "routeros" + }, + { + "count": 36, + "key": "ubuntu" + }, + { + "count": 33, + "key": "debian_linux" + }, + { + "count": 31, + "key": "centos" + }, + { + "count": 10, + "key": "adaptive_security_appliance_software" + }, + { + "count": 10, + "key": "proxmox" + }, + { + "count": 4, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "freebsd" + } + ], + "is_more_than_total_hits": false, + "other_count": 10, + "query_duration_millis": 195, + "total_count": 13554 + } + } + } + }, + "AS14956": { + "name": "ROUTERHOSTING (RouterHosting LLC)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 15480, + "key": "22" + }, + { + "count": 8450, + "key": "443" + }, + { + "count": 7520, + "key": "3389" + }, + { + "count": 7412, + "key": "80" + }, + { + "count": 1091, + "key": "2096" + }, + { + "count": 1021, + "key": "5985" + }, + { + "count": 985, + "key": "135" + }, + { + "count": 842, + "key": "445" + }, + { + "count": 797, + "key": "53" + }, + { + "count": 786, + "key": "8443" + } + ], + "is_more_than_total_hits": false, + "other_count": 20519, + "query_duration_millis": 125, + "total_count": 25654 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 14570, + "key": "openssh" + }, + { + "count": 10034, + "key": "nginx" + }, + { + "count": 2567, + "key": "express" + }, + { + "count": 1582, + "key": "http_server" + }, + { + "count": 1224, + "key": "dovecot" + }, + { + "count": 1124, + "key": "http_api" + }, + { + "count": 859, + "key": "google_web_services" + }, + { + "count": 804, + "key": "web_server" + }, + { + "count": 705, + "key": "caddy" + }, + { + "count": 666, + "key": "jquery" + } + ], + "is_more_than_total_hits": false, + "other_count": 16007, + "query_duration_millis": 91, + "total_count": 25654 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 25654, + "key": "BULLETPROOF" + }, + { + "count": 210, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 22, + "total_count": 25654 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2029, + "key": "YE2" + }, + { + "count": 1907, + "key": "YE1" + }, + { + "count": 995, + "key": "windows-Dallas0" + }, + { + "count": 977, + "key": "YR1" + }, + { + "count": 967, + "key": "YR2" + }, + { + "count": 870, + "key": "invalid2.invalid" + }, + { + "count": 429, + "key": "windows-Utah-4g" + }, + { + "count": 378, + "key": "www.example.com" + }, + { + "count": 373, + "key": "windows-Amsterd" + }, + { + "count": 343, + "key": "TRAEFIK DEFAULT CERT" + } + ], + "is_more_than_total_hits": false, + "other_count": 13042, + "query_duration_millis": 160, + "total_count": 25654 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 13776, + "key": "linux" + }, + { + "count": 5506, + "key": "windows" + }, + { + "count": 218, + "key": "ubuntu" + }, + { + "count": 135, + "key": "debian_linux" + }, + { + "count": 101, + "key": "routeros" + }, + { + "count": 30, + "key": "freebsd" + }, + { + "count": 21, + "key": "linux_kernel" + }, + { + "count": 21, + "key": "windows_server" + }, + { + "count": 9, + "key": "proxmox" + }, + { + "count": 8, + "key": "adaptive_security_appliance_software" + } + ], + "is_more_than_total_hits": false, + "other_count": 20, + "query_duration_millis": 126, + "total_count": 25654 + } + } + } + }, + "AS216139": { + "name": "IRONHOST", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 5492, + "key": "22" + }, + { + "count": 3315, + "key": "443" + }, + { + "count": 2125, + "key": "80" + }, + { + "count": 946, + "key": "51821" + }, + { + "count": 782, + "key": "53" + }, + { + "count": 621, + "key": "21" + }, + { + "count": 554, + "key": "2096" + }, + { + "count": 464, + "key": "25" + }, + { + "count": 425, + "key": "110" + }, + { + "count": 410, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 8904, + "query_duration_millis": 46, + "total_count": 9100 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4460, + "key": "openssh" + }, + { + "count": 2997, + "key": "nginx" + }, + { + "count": 1354, + "key": "dovecot" + }, + { + "count": 1069, + "key": "ddos-guard" + }, + { + "count": 933, + "key": "wg-easy" + }, + { + "count": 836, + "key": "exim" + }, + { + "count": 783, + "key": "express" + }, + { + "count": 625, + "key": "google_web_services" + }, + { + "count": 623, + "key": "web_server" + }, + { + "count": 399, + "key": "bind" + } + ], + "is_more_than_total_hits": false, + "other_count": 5971, + "query_duration_millis": 277, + "total_count": 9100 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 9100, + "key": "BULLETPROOF" + }, + { + "count": 4, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 52, + "total_count": 9100 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 701, + "key": "invalid2.invalid" + }, + { + "count": 634, + "key": "YE1" + }, + { + "count": 604, + "key": "YE2" + }, + { + "count": 404, + "key": "GlobalSign GCC R6 AlphaSSL CA 2025" + }, + { + "count": 231, + "key": "YR2" + }, + { + "count": 220, + "key": "YR1" + }, + { + "count": 203, + "key": "WE1" + }, + { + "count": 189, + "key": "idrac" + }, + { + "count": 179, + "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate" + }, + { + "count": 177, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + } + ], + "is_more_than_total_hits": false, + "other_count": 3551, + "query_duration_millis": 173, + "total_count": 9100 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 3886, + "key": "linux" + }, + { + "count": 184, + "key": "ubuntu" + }, + { + "count": 55, + "key": "enterprise_linux" + }, + { + "count": 53, + "key": "routeros" + }, + { + "count": 32, + "key": "debian_linux" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 16, + "key": "adaptive_security_appliance_software" + }, + { + "count": 4, + "key": "freebsd" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "linux_ami" + } + ], + "is_more_than_total_hits": false, + "other_count": 1, + "query_duration_millis": 1440, + "total_count": 9100 + } + } + } + }, + "AS51852": { + "name": "PLI-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 4338, + "key": "443" + }, + { + "count": 4060, + "key": "22" + }, + { + "count": 3590, + "key": "161" + }, + { + "count": 2799, + "key": "80" + }, + { + "count": 1886, + "key": "123" + }, + { + "count": 1547, + "key": "53" + }, + { + "count": 829, + "key": "25" + }, + { + "count": 829, + "key": "500" + }, + { + "count": 798, + "key": "21" + }, + { + "count": 796, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 15977, + "query_duration_millis": 966, + "total_count": 8641 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4731, + "key": "nginx" + }, + { + "count": 4036, + "key": "openssh" + }, + { + "count": 2536, + "key": "dovecot" + }, + { + "count": 1391, + "key": "exim" + }, + { + "count": 819, + "key": "openvpn_access_server" + }, + { + "count": 816, + "key": "cpanel" + }, + { + "count": 753, + "key": "bind" + }, + { + "count": 740, + "key": "http_server" + }, + { + "count": 598, + "key": "ceph" + }, + { + "count": 512, + "key": "webmail" + } + ], + "is_more_than_total_hits": false, + "other_count": 8305, + "query_duration_millis": 143, + "total_count": 8641 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 8641, + "key": "BULLETPROOF" + }, + { + "count": 39, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 131, + "total_count": 8641 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1906, + "key": "server" + }, + { + "count": 1451, + "key": "YR2" + }, + { + "count": 962, + "key": "YR1" + }, + { + "count": 903, + "key": "Hydra Authentication RSA SubCA #155" + }, + { + "count": 804, + "key": "server.domain.com" + }, + { + "count": 534, + "key": "YE2" + }, + { + "count": 405, + "key": "YE1" + }, + { + "count": 348, + "key": "server.ibras.eu" + }, + { + "count": 295, + "key": "''" + }, + { + "count": 263, + "key": "invalid2.invalid" + } + ], + "is_more_than_total_hits": false, + "other_count": 4001, + "query_duration_millis": 132, + "total_count": 8641 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 3029, + "key": "linux" + }, + { + "count": 208, + "key": "windows" + }, + { + "count": 157, + "key": "proxmox" + }, + { + "count": 129, + "key": "enterprise_linux" + }, + { + "count": 47, + "key": "ubuntu" + }, + { + "count": 36, + "key": "debian_linux" + }, + { + "count": 32, + "key": "freebsd" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 22, + "key": "routeros" + }, + { + "count": 17, + "key": "vmware_esxi_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 21, + "query_duration_millis": 177, + "total_count": 8641 + } + } + } + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 6669, + "key": "22" + }, + { + "count": 3214, + "key": "443" + }, + { + "count": 1298, + "key": "80" + }, + { + "count": 1045, + "key": "2096" + }, + { + "count": 494, + "key": "8443" + }, + { + "count": 193, + "key": "2222" + }, + { + "count": 192, + "key": "8080" + }, + { + "count": 183, + "key": "3389" + }, + { + "count": 174, + "key": "2053" + }, + { + "count": 121, + "key": "25" + } + ], + "is_more_than_total_hits": false, + "other_count": 4258, + "query_duration_millis": 61, + "total_count": 7781 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5750, + "key": "openssh" + }, + { + "count": 1959, + "key": "nginx" + }, + { + "count": 909, + "key": "google_web_services" + }, + { + "count": 906, + "key": "web_server" + }, + { + "count": 434, + "key": "app_and_api_protector" + }, + { + "count": 434, + "key": "ghost" + }, + { + "count": 321, + "key": "waf" + }, + { + "count": 306, + "key": "cloudflare_load_balancer" + }, + { + "count": 266, + "key": "caddy" + }, + { + "count": 237, + "key": "express" + } + ], + "is_more_than_total_hits": false, + "other_count": 2595, + "query_duration_millis": 179, + "total_count": 7781 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7781, + "key": "BULLETPROOF" + }, + { + "count": 41, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 41, + "total_count": 7781 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 998, + "key": "YE2" + }, + { + "count": 908, + "key": "invalid2.invalid" + }, + { + "count": 877, + "key": "YE1" + }, + { + "count": 253, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 244, + "key": "YR2" + }, + { + "count": 198, + "key": "WE1" + }, + { + "count": 191, + "key": "YR1" + }, + { + "count": 136, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 105, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 100, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ], + "is_more_than_total_hits": false, + "other_count": 2008, + "query_duration_millis": 122, + "total_count": 7781 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 5522, + "key": "linux" + }, + { + "count": 63, + "key": "ubuntu" + }, + { + "count": 44, + "key": "windows" + }, + { + "count": 26, + "key": "debian_linux" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 9, + "key": "adaptive_security_appliance_software" + }, + { + "count": 5, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "centos" + }, + { + "count": 2, + "key": "freebsd" + }, + { + "count": 1, + "key": "linux_ami" + } + ], + "is_more_than_total_hits": false, + "other_count": 1, + "query_duration_millis": 28, + "total_count": 7781 + } + } + } + }, + "AS33993": { + "name": "UFO-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 3135, + "key": "22" + }, + { + "count": 2062, + "key": "443" + }, + { + "count": 2022, + "key": "80" + }, + { + "count": 1411, + "key": "53" + }, + { + "count": 713, + "key": "21" + }, + { + "count": 601, + "key": "3000" + }, + { + "count": 555, + "key": "1500" + }, + { + "count": 548, + "key": "25" + }, + { + "count": 523, + "key": "993" + }, + { + "count": 512, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 9561, + "query_duration_millis": 362, + "total_count": 4842 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 3759, + "key": "nginx" + }, + { + "count": 3248, + "key": "openssh" + }, + { + "count": 1719, + "key": "dovecot" + }, + { + "count": 1155, + "key": "exim" + }, + { + "count": 1141, + "key": "bind" + }, + { + "count": 570, + "key": "proftpd" + }, + { + "count": 384, + "key": "express" + }, + { + "count": 290, + "key": "python" + }, + { + "count": 230, + "key": "aiohttp" + }, + { + "count": 228, + "key": "bootstrap" + } + ], + "is_more_than_total_hits": false, + "other_count": 3414, + "query_duration_millis": 42, + "total_count": 4842 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 4842, + "key": "BULLETPROOF" + }, + { + "count": 9, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 50, + "total_count": 4842 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 769, + "key": "YR2" + }, + { + "count": 715, + "key": "YR1" + }, + { + "count": 516, + "key": "YE2" + }, + { + "count": 487, + "key": "YE1" + }, + { + "count": 322, + "key": "ssl.by" + }, + { + "count": 242, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 173, + "key": "issssrt.ru" + }, + { + "count": 124, + "key": "GlobalSign GCC R3 DV TLS CA 2020" + }, + { + "count": 113, + "key": "invalid2.invalid" + }, + { + "count": 105, + "key": "TRAEFIK DEFAULT CERT" + } + ], + "is_more_than_total_hits": false, + "other_count": 4885, + "query_duration_millis": 107, + "total_count": 4842 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 2989, + "key": "linux" + }, + { + "count": 132, + "key": "ubuntu" + }, + { + "count": 57, + "key": "windows" + }, + { + "count": 38, + "key": "enterprise_linux" + }, + { + "count": 23, + "key": "debian_linux" + }, + { + "count": 21, + "key": "routeros" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 4, + "key": "windows_server" + }, + { + "count": 3, + "key": "linux_kernel" + } + ], + "is_more_than_total_hits": false, + "other_count": 5, + "query_duration_millis": 335, + "total_count": 4842 + } + } + } + }, + "AS51396": { + "name": "PFCLOUD (Pfcloud UG)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 838, + "key": "22" + }, + { + "count": 360, + "key": "80" + }, + { + "count": 281, + "key": "443" + }, + { + "count": 129, + "key": "3389" + }, + { + "count": 100, + "key": "1407" + }, + { + "count": 99, + "key": "11407" + }, + { + "count": 94, + "key": "135" + }, + { + "count": 93, + "key": "445" + }, + { + "count": 87, + "key": "5985" + }, + { + "count": 84, + "key": "139" + } + ], + "is_more_than_total_hits": false, + "other_count": 3342, + "query_duration_millis": 457, + "total_count": 1917 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 744, + "key": "openssh" + }, + { + "count": 398, + "key": "nginx" + }, + { + "count": 191, + "key": "http_server" + }, + { + "count": 129, + "key": "http_api" + }, + { + "count": 105, + "key": "express" + }, + { + "count": 69, + "key": "php" + }, + { + "count": 53, + "key": "python" + }, + { + "count": 48, + "key": "jquery" + }, + { + "count": 48, + "key": "pve" + }, + { + "count": 48, + "key": "virtual_environment" + } + ], + "is_more_than_total_hits": false, + "other_count": 801, + "query_duration_millis": 1064, + "total_count": 1917 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 1917, + "key": "BULLETPROOF" + }, + { + "count": 15, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 159, + "total_count": 1917 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 110, + "key": "YE1" + }, + { + "count": 105, + "key": "YE2" + }, + { + "count": 45, + "key": "YR2" + }, + { + "count": 42, + "key": "YR1" + }, + { + "count": 27, + "key": "WIN-9QL4SDRB93L" + }, + { + "count": 24, + "key": "localhost" + }, + { + "count": 20, + "key": "Proxmox Virtual Environment" + }, + { + "count": 20, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 20, + "key": "WIN-IK7N6SD2UBU" + }, + { + "count": 17, + "key": "invalid2.invalid" + } + ], + "is_more_than_total_hits": false, + "other_count": 440, + "query_duration_millis": 126, + "total_count": 1917 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 668, + "key": "linux" + }, + { + "count": 85, + "key": "windows" + }, + { + "count": 39, + "key": "debian_linux" + }, + { + "count": 22, + "key": "proxmox" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "centos" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 72, + "total_count": 1917 + } + } + } + }, + "AS213702": { + "name": "QWINS-LTD", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 6376, + "key": "22" + }, + { + "count": 4393, + "key": "443" + }, + { + "count": 2150, + "key": "80" + }, + { + "count": 2020, + "key": "2222" + }, + { + "count": 820, + "key": "8443" + }, + { + "count": 671, + "key": "2096" + }, + { + "count": 404, + "key": "3389" + }, + { + "count": 242, + "key": "8080" + }, + { + "count": 193, + "key": "2053" + }, + { + "count": 160, + "key": "9443" + } + ], + "is_more_than_total_hits": false, + "other_count": 4685, + "query_duration_millis": 3206, + "total_count": 7381 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 6147, + "key": "openssh" + }, + { + "count": 3386, + "key": "nginx" + }, + { + "count": 621, + "key": "caddy" + }, + { + "count": 522, + "key": "google_web_services" + }, + { + "count": 521, + "key": "web_server" + }, + { + "count": 472, + "key": "app_and_api_protector" + }, + { + "count": 472, + "key": "ghost" + }, + { + "count": 333, + "key": "express" + }, + { + "count": 266, + "key": "waf" + }, + { + "count": 254, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 2854, + "query_duration_millis": 37, + "total_count": 7381 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7381, + "key": "BULLETPROOF" + }, + { + "count": 16, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 27, + "total_count": 7381 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1187, + "key": "YE2" + }, + { + "count": 1098, + "key": "YE1" + }, + { + "count": 768, + "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo" + }, + { + "count": 524, + "key": "invalid2.invalid" + }, + { + "count": 331, + "key": "YR2" + }, + { + "count": 234, + "key": "YR1" + }, + { + "count": 217, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 193, + "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5" + }, + { + "count": 185, + "key": "NvJhHp68p5mjSuW_EK9Lab6bH9" + }, + { + "count": 169, + "key": "WE1" + } + ], + "is_more_than_total_hits": false, + "other_count": 3494, + "query_duration_millis": 144, + "total_count": 7381 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6029, + "key": "linux" + }, + { + "count": 98, + "key": "windows" + }, + { + "count": 63, + "key": "ubuntu" + }, + { + "count": 14, + "key": "debian_linux" + }, + { + "count": 10, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "enterprise_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 49, + "total_count": 7381 + } + } + } + }, + "AS216246": { + "name": "RU-AEZA-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 5672, + "key": "22" + }, + { + "count": 4259, + "key": "443" + }, + { + "count": 3282, + "key": "80" + }, + { + "count": 704, + "key": "2096" + }, + { + "count": 693, + "key": "8443" + }, + { + "count": 390, + "key": "8080" + }, + { + "count": 368, + "key": "2222" + }, + { + "count": 310, + "key": "3389" + }, + { + "count": 193, + "key": "3000" + }, + { + "count": 179, + "key": "3478" + } + ], + "is_more_than_total_hits": false, + "other_count": 5444, + "query_duration_millis": 519, + "total_count": 7024 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5230, + "key": "openssh" + }, + { + "count": 5040, + "key": "nginx" + }, + { + "count": 642, + "key": "caddy" + }, + { + "count": 501, + "key": "express" + }, + { + "count": 284, + "key": "dovecot" + }, + { + "count": 261, + "key": "ghost" + }, + { + "count": 260, + "key": "app_and_api_protector" + }, + { + "count": 238, + "key": "traefik_proxy" + }, + { + "count": 232, + "key": "next.js" + }, + { + "count": 221, + "key": "next\\.js" + } + ], + "is_more_than_total_hits": false, + "other_count": 3954, + "query_duration_millis": 92, + "total_count": 7024 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 7024, + "key": "BULLETPROOF" + }, + { + "count": 136, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 112, + "total_count": 7024 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1388, + "key": "YE1" + }, + { + "count": 1307, + "key": "YE2" + }, + { + "count": 349, + "key": "YR2" + }, + { + "count": 275, + "key": "YR1" + }, + { + "count": 273, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 239, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 202, + "key": "invalid2.invalid" + }, + { + "count": 155, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 119, + "key": "WE1" + }, + { + "count": 113, + "key": "WR1" + } + ], + "is_more_than_total_hits": false, + "other_count": 2483, + "query_duration_millis": 186, + "total_count": 7024 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 5090, + "key": "linux" + }, + { + "count": 220, + "key": "ubuntu" + }, + { + "count": 135, + "key": "windows" + }, + { + "count": 30, + "key": "debian_linux" + }, + { + "count": 10, + "key": "routeros" + }, + { + "count": 7, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "windows_server" + }, + { + "count": 1, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 152, + "total_count": 7024 + } + } + } + }, + "AS200651": { + "name": "FLOKINET", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 2841, + "key": "22" + }, + { + "count": 2118, + "key": "443" + }, + { + "count": 1917, + "key": "80" + }, + { + "count": 380, + "key": "53" + }, + { + "count": 282, + "key": "25" + }, + { + "count": 234, + "key": "587" + }, + { + "count": 222, + "key": "993" + }, + { + "count": 189, + "key": "111" + }, + { + "count": 186, + "key": "143" + }, + { + "count": 168, + "key": "110" + } + ], + "is_more_than_total_hits": false, + "other_count": 4831, + "query_duration_millis": 180, + "total_count": 3806 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 2825, + "key": "nginx" + }, + { + "count": 2589, + "key": "openssh" + }, + { + "count": 585, + "key": "dovecot" + }, + { + "count": 465, + "key": "http_server" + }, + { + "count": 361, + "key": "cpanel" + }, + { + "count": 303, + "key": "express" + }, + { + "count": 270, + "key": "exim" + }, + { + "count": 258, + "key": "caddy" + }, + { + "count": 247, + "key": "openresty" + }, + { + "count": 196, + "key": "authoritative_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 3469, + "query_duration_millis": 79, + "total_count": 3806 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 3806, + "key": "BULLETPROOF" + }, + { + "count": 130, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 20, + "total_count": 3806 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 725, + "key": "YE1" + }, + { + "count": 637, + "key": "YR2" + }, + { + "count": 612, + "key": "YE2" + }, + { + "count": 562, + "key": "YR1" + }, + { + "count": 131, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 99, + "key": "invalid2.invalid" + }, + { + "count": 59, + "key": "localhost" + }, + { + "count": 47, + "key": "WE1" + }, + { + "count": 40, + "key": "GlobalSign Atlas R3 DV TLS CA 2025 Q3" + }, + { + "count": 40, + "key": "www.example.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 1621, + "query_duration_millis": 128, + "total_count": 3806 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 2167, + "key": "linux" + }, + { + "count": 56, + "key": "ubuntu" + }, + { + "count": 48, + "key": "debian_linux" + }, + { + "count": 30, + "key": "proxmox" + }, + { + "count": 27, + "key": "windows" + }, + { + "count": 10, + "key": "freebsd" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "openbsd" + }, + { + "count": 5, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 8, + "query_duration_millis": 162, + "total_count": 3806 + } + } + } + }, + "AS30823": { + "name": "AUROLOGIC (aurologic GmbH)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 1203, + "key": "22" + }, + { + "count": 808, + "key": "443" + }, + { + "count": 614, + "key": "80" + }, + { + "count": 457, + "key": "53" + }, + { + "count": 388, + "key": "27015" + }, + { + "count": 296, + "key": "3389" + }, + { + "count": 109, + "key": "25" + }, + { + "count": 109, + "key": "8443" + }, + { + "count": 95, + "key": "2096" + }, + { + "count": 84, + "key": "8080" + } + ], + "is_more_than_total_hits": false, + "other_count": 2409, + "query_duration_millis": 98, + "total_count": 2036 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1113, + "key": "openssh" + }, + { + "count": 776, + "key": "nginx" + }, + { + "count": 198, + "key": "express" + }, + { + "count": 137, + "key": "http_server" + }, + { + "count": 102, + "key": "google_web_services" + }, + { + "count": 102, + "key": "web_server" + }, + { + "count": 92, + "key": "dovecot" + }, + { + "count": 92, + "key": "http_api" + }, + { + "count": 69, + "key": "caddy" + }, + { + "count": 66, + "key": "cloudflare_load_balancer" + } + ], + "is_more_than_total_hits": false, + "other_count": 1549, + "query_duration_millis": 144, + "total_count": 2036 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 2036, + "key": "BULLETPROOF" + }, + { + "count": 28, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 421, + "total_count": 2036 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 201, + "key": "YE2" + }, + { + "count": 198, + "key": "YE1" + }, + { + "count": 108, + "key": "invalid2.invalid" + }, + { + "count": 97, + "key": "YR2" + }, + { + "count": 92, + "key": "YR1" + }, + { + "count": 62, + "key": "windows-DE-Fran" + }, + { + "count": 58, + "key": "172.86.93" + }, + { + "count": 56, + "key": "windows-Frankfu" + }, + { + "count": 51, + "key": "GoGetSSL RSA DV CA" + }, + { + "count": 36, + "key": "WE1" + } + ], + "is_more_than_total_hits": false, + "other_count": 986, + "query_duration_millis": 184, + "total_count": 2036 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1025, + "key": "linux" + }, + { + "count": 162, + "key": "windows" + }, + { + "count": 21, + "key": "proxmox" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 15, + "key": "debian_linux" + }, + { + "count": 11, + "key": "ubuntu" + }, + { + "count": 9, + "key": "centos" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 4, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "megarac_spx" + } + ], + "is_more_than_total_hits": false, + "other_count": 6, + "query_duration_millis": 338, + "total_count": 2036 + } + } + } + }, + "AS140666": { + "name": "ADPL-AS-AP (ANY DIGITAL PTE. LTD.)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 1652, + "key": "22" + }, + { + "count": 694, + "key": "443" + }, + { + "count": 535, + "key": "80" + }, + { + "count": 376, + "key": "6004" + }, + { + "count": 376, + "key": "6011" + }, + { + "count": 375, + "key": "6001" + }, + { + "count": 375, + "key": "6006" + }, + { + "count": 375, + "key": "6007" + }, + { + "count": 375, + "key": "6010" + }, + { + "count": 375, + "key": "6012" + } + ], + "is_more_than_total_hits": false, + "other_count": 12271, + "query_duration_millis": 32, + "total_count": 2805 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1615, + "key": "openssh" + }, + { + "count": 1378, + "key": "nginx" + }, + { + "count": 146, + "key": "openresty" + }, + { + "count": 131, + "key": "http_api" + }, + { + "count": 80, + "key": "jquery" + }, + { + "count": 74, + "key": "internet_information_services" + }, + { + "count": 58, + "key": "tengine" + }, + { + "count": 54, + "key": "bootstrap" + }, + { + "count": 39, + "key": "express" + }, + { + "count": 36, + "key": "node_exporter" + } + ], + "is_more_than_total_hits": false, + "other_count": 575, + "query_duration_millis": 168, + "total_count": 2805 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 2805, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 244, + "total_count": 2805 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 338, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 183, + "key": "NONE" + }, + { + "count": 135, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 109, + "key": "tudog_node_agent._reserved.bytefcdn.com" + }, + { + "count": 107, + "key": "RTCTS" + }, + { + "count": 102, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 92, + "key": "QY" + }, + { + "count": 65, + "key": "RapidSSL TLS ECC CA G1" + }, + { + "count": 60, + "key": "tls.internal.ypc.org" + }, + { + "count": 47, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + } + ], + "is_more_than_total_hits": false, + "other_count": 717, + "query_duration_millis": 67, + "total_count": 2805 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 1089, + "key": "linux" + }, + { + "count": 95, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "proxmox" + }, + { + "count": 1, + "key": "windows_server_2008_r2" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 20, + "total_count": 2805 + } + } + } + }, + "AS214351": { + "name": "FEMOIT", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 547, + "key": "80" + }, + { + "count": 536, + "key": "22" + }, + { + "count": 340, + "key": "443" + }, + { + "count": 94, + "key": "21" + }, + { + "count": 93, + "key": "53" + }, + { + "count": 89, + "key": "25" + }, + { + "count": 87, + "key": "8085" + }, + { + "count": 86, + "key": "22509" + }, + { + "count": 81, + "key": "143" + }, + { + "count": 81, + "key": "993" + } + ], + "is_more_than_total_hits": false, + "other_count": 1019, + "query_duration_millis": 291, + "total_count": 712 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 795, + "key": "nginx" + }, + { + "count": 586, + "key": "openssh" + }, + { + "count": 251, + "key": "express" + }, + { + "count": 216, + "key": "dovecot" + }, + { + "count": 149, + "key": "fastpanel" + }, + { + "count": 147, + "key": "exim" + }, + { + "count": 81, + "key": "http_server" + }, + { + "count": 56, + "key": "proftpd" + }, + { + "count": 37, + "key": "http_api" + }, + { + "count": 37, + "key": "next.js" + } + ], + "is_more_than_total_hits": false, + "other_count": 394, + "query_duration_millis": 40, + "total_count": 712 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 712, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 161, + "total_count": 712 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 97, + "key": "etc" + }, + { + "count": 60, + "key": "YR2" + }, + { + "count": 53, + "key": "vm4660.defhost.co" + }, + { + "count": 51, + "key": "YR1" + }, + { + "count": 39, + "key": "parking" + }, + { + "count": 37, + "key": "FASTPANEL" + }, + { + "count": 34, + "key": "YE2" + }, + { + "count": 31, + "key": "misp.goodip" + }, + { + "count": 27, + "key": "YE1" + }, + { + "count": 15, + "key": "tech0.test" + } + ], + "is_more_than_total_hits": false, + "other_count": 545, + "query_duration_millis": 153, + "total_count": 712 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 516, + "key": "linux" + }, + { + "count": 33, + "key": "windows" + }, + { + "count": 6, + "key": "linux_kernel" + }, + { + "count": 4, + "key": "ubuntu" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + }, + { + "count": 1, + "key": "windows_server" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 162, + "total_count": 712 + } + } + } + }, + "AS198953": { + "name": "PROTON66", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 166, + "key": "3389" + }, + { + "count": 161, + "key": "22" + }, + { + "count": 89, + "key": "80" + }, + { + "count": 83, + "key": "443" + }, + { + "count": 52, + "key": "135" + }, + { + "count": 41, + "key": "137" + }, + { + "count": 39, + "key": "53" + }, + { + "count": 36, + "key": "139" + }, + { + "count": 35, + "key": "5985" + }, + { + "count": 25, + "key": "21" + } + ], + "is_more_than_total_hits": false, + "other_count": 374, + "query_duration_millis": 185, + "total_count": 360 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 128, + "key": "nginx" + }, + { + "count": 123, + "key": "openssh" + }, + { + "count": 63, + "key": "dovecot" + }, + { + "count": 44, + "key": "http_api" + }, + { + "count": 36, + "key": "express" + }, + { + "count": 31, + "key": "http_server" + }, + { + "count": 30, + "key": "fastpanel" + }, + { + "count": 24, + "key": "exim" + }, + { + "count": 22, + "key": "requirejs" + }, + { + "count": 19, + "key": "parallels_plesk_panel" + } + ], + "is_more_than_total_hits": false, + "other_count": 231, + "query_duration_millis": 146, + "total_count": 360 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 360, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 923, + "total_count": 360 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 23, + "key": "Plesk" + }, + { + "count": 19, + "key": "YR1" + }, + { + "count": 16, + "key": "etc" + }, + { + "count": 11, + "key": "AnyDesk Client" + }, + { + "count": 10, + "key": "localhost" + }, + { + "count": 9, + "key": "R11" + }, + { + "count": 9, + "key": "parking" + }, + { + "count": 8, + "key": "R12" + }, + { + "count": 8, + "key": "YR2" + }, + { + "count": 8, + "key": "test" + } + ], + "is_more_than_total_hits": false, + "other_count": 272, + "query_duration_millis": 147, + "total_count": 360 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 117, + "key": "linux" + }, + { + "count": 41, + "key": "windows" + }, + { + "count": 4, + "key": "ubuntu" + }, + { + "count": 3, + "key": "debian_linux" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "freenas_firmware" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "routeros" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 25, + "total_count": 360 + } + } + } + }, + "AS200593": { + "name": "PROSPERO-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 201, + "key": "22" + }, + { + "count": 133, + "key": "3389" + }, + { + "count": 113, + "key": "80" + }, + { + "count": 81, + "key": "443" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 26, + "key": "135" + }, + { + "count": 26, + "key": "5985" + }, + { + "count": 23, + "key": "21" + }, + { + "count": 21, + "key": "25" + }, + { + "count": 20, + "key": "143" + } + ], + "is_more_than_total_hits": false, + "other_count": 310, + "query_duration_millis": 245, + "total_count": 348 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 150, + "key": "nginx" + }, + { + "count": 137, + "key": "openssh" + }, + { + "count": 60, + "key": "dovecot" + }, + { + "count": 35, + "key": "parallels_plesk_panel" + }, + { + "count": 35, + "key": "prototype" + }, + { + "count": 35, + "key": "requirejs" + }, + { + "count": 33, + "key": "express" + }, + { + "count": 30, + "key": "http_server" + }, + { + "count": 29, + "key": "http_api" + }, + { + "count": 24, + "key": "plesk" + } + ], + "is_more_than_total_hits": false, + "other_count": 180, + "query_duration_millis": 32, + "total_count": 348 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 348, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 97, + "total_count": 348 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 42, + "key": "Plesk" + }, + { + "count": 29, + "key": "YR1" + }, + { + "count": 24, + "key": "YR2" + }, + { + "count": 13, + "key": "YE1" + }, + { + "count": 12, + "key": "R13" + }, + { + "count": 9, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 7, + "key": "DESKTOP-GKGI28A" + }, + { + "count": 6, + "key": "R12" + }, + { + "count": 6, + "key": "ckicksp-1.example.com" + }, + { + "count": 6, + "key": "devin-coo-1.example.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 207, + "query_duration_millis": 183, + "total_count": 348 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 138, + "key": "linux" + }, + { + "count": 26, + "key": "windows" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "ubuntu" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 262, + "total_count": 348 + } + } + } + }, + "AS214940": { + "name": "KPRONET", + "agg": { + "host.services.port": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 118, + "total_count": 0 + } + }, + "host.services.software.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 39, + "total_count": 0 + } + }, + "host.labels.value": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 1001, + "total_count": 0 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 126, + "total_count": 0 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 568, + "total_count": 0 + } + } + } + }, + "AS206728": { + "name": "MEDIALAND-AS", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "80" + }, + { + "count": 3, + "key": "53" + }, + { + "count": 2, + "key": "22" + }, + { + "count": 2, + "key": "445" + }, + { + "count": 2, + "key": "5910" + }, + { + "count": 2, + "key": "5934" + }, + { + "count": 1, + "key": "135" + }, + { + "count": 1, + "key": "139" + }, + { + "count": 1, + "key": "500" + } + ], + "is_more_than_total_hits": false, + "other_count": 7, + "query_duration_millis": 26, + "total_count": 20 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 5, + "key": "nginx" + }, + { + "count": 4, + "key": "http_api" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "asp\\.net" + }, + { + "count": 2, + "key": "internet_information_services" + }, + { + "count": 1, + "key": "moment" + }, + { + "count": 1, + "key": "openssh" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 89, + "total_count": 20 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 20, + "key": "BULLETPROOF" + }, + { + "count": 6, + "key": "IPV6" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 777, + "total_count": 20 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "hotelsoft.cer" + }, + { + "count": 1, + "key": "invalid2.invalid" + }, + { + "count": 1, + "key": "v673" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 132, + "total_count": 20 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 6, + "key": "windows" + }, + { + "count": 1, + "key": "linux" + }, + { + "count": 1, + "key": "routeros" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 58, + "total_count": 20 + } + } + } + }, + "AS211720": { + "name": "Datashield, Inc.", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 28, + "key": "22" + }, + { + "count": 19, + "key": "3389" + }, + { + "count": 14, + "key": "179" + }, + { + "count": 9, + "key": "80" + }, + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "111" + }, + { + "count": 6, + "key": "5985" + }, + { + "count": 4, + "key": "8081" + }, + { + "count": 3, + "key": "8080" + }, + { + "count": 2, + "key": "135" + } + ], + "is_more_than_total_hits": false, + "other_count": 14, + "query_duration_millis": 260, + "total_count": 50 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 11, + "key": "nginx" + }, + { + "count": 6, + "key": "http_api" + }, + { + "count": 2, + "key": "mariadb" + }, + { + "count": 2, + "key": "tor" + }, + { + "count": 1, + "key": "caddy" + }, + { + "count": 1, + "key": "dropbear_ssh" + }, + { + "count": 1, + "key": "gunicorn" + }, + { + "count": 1, + "key": "http_server" + }, + { + "count": 1, + "key": "libupnp" + } + ], + "is_more_than_total_hits": false, + "other_count": 2, + "query_duration_millis": 111, + "total_count": 50 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 50, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 80, + "total_count": 50 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 3, + "key": "IPMI" + }, + { + "count": 2, + "key": "FREE" + }, + { + "count": 1, + "key": "WIN-JDCEOBUFJUS" + }, + { + "count": 1, + "key": "WIN-JP7KUDECHOR" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "YE2" + }, + { + "count": 1, + "key": "YR2" + }, + { + "count": 1, + "key": "agent-ca@1757674441" + }, + { + "count": 1, + "key": "agent-ca@1757925038" + }, + { + "count": 1, + "key": "agent-ca@1759158944" + } + ], + "is_more_than_total_hits": false, + "other_count": 16, + "query_duration_millis": 122, + "total_count": 50 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 10, + "key": "linux" + }, + { + "count": 3, + "key": "windows" + }, + { + "count": 1, + "key": "debian_linux" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 98, + "total_count": 50 + } + } + } + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 35, + "key": "22" + }, + { + "count": 13, + "key": "80" + }, + { + "count": 8, + "key": "443" + }, + { + "count": 4, + "key": "111" + }, + { + "count": 2, + "key": "25" + }, + { + "count": 2, + "key": "53" + }, + { + "count": 2, + "key": "110" + }, + { + "count": 2, + "key": "143" + }, + { + "count": 2, + "key": "161" + }, + { + "count": 2, + "key": "993" + } + ], + "is_more_than_total_hits": false, + "other_count": 36, + "query_duration_millis": 24, + "total_count": 37 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 16, + "key": "nginx" + }, + { + "count": 10, + "key": "http_server" + }, + { + "count": 9, + "key": "express" + }, + { + "count": 6, + "key": "bootstrap" + }, + { + "count": 6, + "key": "dovecot" + }, + { + "count": 6, + "key": "php" + }, + { + "count": 5, + "key": "prototype" + }, + { + "count": 4, + "key": "jquery" + }, + { + "count": 4, + "key": "openssl" + } + ], + "is_more_than_total_hits": false, + "other_count": 34, + "query_duration_millis": 198, + "total_count": 37 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 37, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 197, + "total_count": 37 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 9, + "key": "YR2" + }, + { + "count": 4, + "key": "Plesk" + }, + { + "count": 3, + "key": "YE2" + }, + { + "count": 3, + "key": "YR1" + }, + { + "count": 2, + "key": "pbx.invisiontech.eu" + }, + { + "count": 1, + "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate" + }, + { + "count": 1, + "key": "OpenWrt" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "www.jxb5pzqmff4pcbab.com" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 134, + "total_count": 37 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 12, + "key": "linux" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "proxmox" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 49, + "total_count": 37 + } + } + } + }, + "AS58854": { + "name": "KAOPY (Kaopu Cloud)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 180, + "key": "8887" + }, + { + "count": 177, + "key": "80" + }, + { + "count": 163, + "key": "443" + }, + { + "count": 116, + "key": "0" + }, + { + "count": 82, + "key": "8081" + }, + { + "count": 79, + "key": "8888" + }, + { + "count": 78, + "key": "111" + }, + { + "count": 74, + "key": "16257" + }, + { + "count": 74, + "key": "16259" + }, + { + "count": 72, + "key": "16258" + } + ], + "is_more_than_total_hits": false, + "other_count": 4440, + "query_duration_millis": 120, + "total_count": 624 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 1169, + "key": "mysql" + }, + { + "count": 349, + "key": "nginx" + }, + { + "count": 228, + "key": "python" + }, + { + "count": 183, + "key": "wsgiserver" + }, + { + "count": 163, + "key": "jquery" + }, + { + "count": 152, + "key": "bootstrap" + }, + { + "count": 103, + "key": "node_exporter" + }, + { + "count": 79, + "key": "openssh" + }, + { + "count": 78, + "key": "kestrel_web_server" + }, + { + "count": 72, + "key": "cadvisor" + } + ], + "is_more_than_total_hits": false, + "other_count": 279, + "query_duration_millis": 536, + "total_count": 624 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 624, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 102, + "total_count": 624 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 47, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 13, + "key": "TrustAsia DV TLS RSA CA 2025" + }, + { + "count": 10, + "key": "FtpServer" + }, + { + "count": 9, + "key": "YR1" + }, + { + "count": 8, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 6, + "key": "TrustAsia DV TLS RSA CA 2024" + }, + { + "count": 5, + "key": "IPMI" + }, + { + "count": 5, + "key": "WIN-RIK6D08VRRQ" + }, + { + "count": 4, + "key": "Firecloud Root Client Certification Authority" + }, + { + "count": 4, + "key": "Sectigo Public Server Authentication CA DV R36" + } + ], + "is_more_than_total_hits": false, + "other_count": 78, + "query_duration_millis": 101, + "total_count": 624 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 33, + "key": "linux" + }, + { + "count": 26, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "centos" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 411, + "total_count": 624 + } + } + } + }, + "AS202685": { + "name": "TR-ARKEL", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 4, + "key": "80" + }, + { + "count": 2, + "key": "443" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 484, + "total_count": 4 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "internet_information_services" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "asp\\.net" + }, + { + "count": 2, + "key": "http_api" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 154, + "total_count": 4 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 4, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 116, + "total_count": 4 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 1, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1, + "key": "YR1" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 155, + "total_count": 4 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "windows" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 120, + "total_count": 4 + } + } + } + }, + "AS394711": { + "name": "KORGRID (KorGrid LLC)", + "agg": { + "host.services.port": { + "result": { + "buckets": [ + { + "count": 2, + "key": "80" + }, + { + "count": 2, + "key": "443" + }, + { + "count": 1, + "key": "3389" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 272, + "total_count": 3 + } + }, + "host.services.software.product": { + "result": { + "buckets": [ + { + "count": 4, + "key": "bootstrap" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 31, + "total_count": 3 + } + }, + "host.labels.value": { + "result": { + "buckets": [ + { + "count": 3, + "key": "BULLETPROOF" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 25, + "total_count": 3 + } + }, + "host.services.cert.parsed.issuer.common_name": { + "result": { + "buckets": [ + { + "count": 2, + "key": "vergeos.local.root" + }, + { + "count": 1, + "key": "pcmrp-test" + } + ], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 113, + "total_count": 3 + } + }, + "host.operating_system.product": { + "result": { + "buckets": [], + "is_more_than_total_hits": false, + "other_count": 0, + "query_duration_millis": 158, + "total_count": 3 + } + } + } + } +} \ No newline at end of file -- cgit v1.2.3