index=YOUR_PROXY_INDEX earliest="09/28/2026:00:00:00" latest="10/18/2026:00:00:00"
(kuroneko OR yamato)
| eval host_l=lower(YOUR_URL_HOST_FIELD)
| where match(host_l, "kuroneko|yamato")
    AND NOT match(host_l, "(^|\\.)(kuronekoyamato\\.co\\.jp|yamato-hd\\.co\\.jp)$")
| stats count min(_time) AS first_seen max(_time) AS last_seen BY host_l YOUR_CLIENT_FIELD
| convert ctime(first_seen) ctime(last_seen)
| sort - count
| head 200