1import{u as re,c as ce,d as le,r as p,f as X,a as C,s as q,A as oe,e as K,n as de,j as e,S as Z,G as xe,B as te,g as me,h as Y,L as S,t as pe,k as he,l as se,m as ue}from"./index-utzdZf0y.js";import{S as be}from"./ScanSearch-CjYbMnXZ.js";import{s as ge}from"./export-CU8oKtWu.js";import{D as fe,C as ae}from"./DownloadReportButtons-S9yL3owQ.js";const je={official:"Official property",impersonating:"Impersonating",mentions:"Mentions only",unrelated:"Unrelated"},ve={official:"border-verdict-clean/30 bg-verdict-clean/10 text-verdict-clean",impersonating:"border-verdict-malicious/30 bg-verdict-malicious/10 text-verdict-malicious",mentions:"border-border-default bg-bg-inset text-text-secondary",unrelated:"border-border-default bg-bg-inset text-text-muted"},ye={"organization-validated":"Names a verified organization","domain-validated":"Proves control of the name only (no organization)","self-signed":"Self-signed - establishes no identity",none:"No certificate (served over plain HTTP or unreachable)"},ne={malicious:"text-verdict-malicious",suspicious:"text-verdict-suspicious",clean:"text-verdict-clean",unknown:"text-text-muted",insufficient:"text-text-muted"},ie={malicious:"bg-verdict-malicious/10 border-verdict-malicious/40",suspicious:"bg-verdict-suspicious/10 border-verdict-suspicious/40",clean:"bg-verdict-clean/10 border-verdict-clean/40",unknown:"bg-bg-overlay border-border-default",insufficient:"bg-bg-overlay border-border-default"};function Oe(){var O,B,H,s,d,w;const t=!!he().accessToken,[a,i]=re(),o=ce(),{uuid:n}=le(),[r,u]=p.useState(()=>X(a)??""),[k,v]=p.useState("standard"),[f,P]=p.useState(t?"private":"public"),[j,U]=p.useState("single"),[m,h]=p.useState("idle"),[$,R]=p.useState(null),[b,E]=p.useState(null),[A,_]=p.useState([]),D=p.useRef(null),M=p.useRef(!1);p.useEffect(()=>()=>{D.current&&clearTimeout(D.current)},[]);const L=p.useCallback(async()=>{try{const{scans:c}=await C.scanRecent(30);_(c)}catch{}},[]);p.useEffect(()=>{L()},[L]),p.useEffect(()=>{m==="done"&&L()},[m,L]);const y=p.useCallback(async(c,g=0,J=0)=>{var Q;try{const{data:N}=await C.scanResult(c);E(N);const T=q(c,(Q=N.page)==null?void 0:Q.domain);if(T.startsWith("/scan/")?`${window.location.pathname}`!==T&&o(T,{replace:!0}):i(z=>{if(z.get("uuid")===c)return z;const V=new URLSearchParams(z);return V.set("uuid",c),V.delete("u"),V.delete("url"),V},{replace:!0}),N.status==="done"||N.status==="error"){h(N.status==="error"?"error":"done"),N.status==="error"&&R("Scan failed (the target may be unreachable or blocked).");return}g<120?D.current=setTimeout(()=>void y(c,g+1,0),500):h("done")}catch(N){const T=N instanceof oe?N.status:0;if((T===404||T===502||T===503||T===0)&&J<8){D.current=setTimeout(()=>void y(c,g+1,J+1),600);return}h("error"),R(K(N))}},[i,o]),I=p.useCallback(async()=>{if(!r.trim())return;R(null),E(null);const c=de(r);if(!c){h("error"),R("That does not look like a URL or domain. Try something like example.com or https://example.com/login.");return}h("scanning");try{const{data:g}=await C.scanUrl({url:c,tier:k,visibility:t?f:"public",captchaToken:t?void 0:"dev-captcha-ok"});if(g.cached){await y(g.uuid);return}await y(g.uuid)}catch(g){h("error"),R(K(g))}},[r,k,f,t,y]);return p.useEffect(()=>{if(M.current)return;const c=n??a.get("uuid");if(c){M.current=!0,h("scanning"),y(c);return}X(a)&&(M.current=!0,i({},{replace:!0}),I())},[a,n,I,i,y]),e.jsxs("div",{className:"mx-auto max-w-5xl",children:[b?e.jsx(Z,{title:`${((O=b.page)==null?void 0:O.domain)||"URL"} - URL scan`,description:`MalwareAnalyzer scan of ${((B=b.page)==null?void 0:B.domain)||((H=b.task)==null?void 0:H.url)||"a URL"}: ${((s=b.verdicts)==null?void 0:s.verdict)??"pending"} verdict${typeof((d=b.verdicts)==null?void 0:d.score)=="number"?`, score ${b.verdicts.score}`:""}.`,canonicalPath:q(b.uuid,(w=b.page)==null?void 0:w.domain),type:"article"}):e.jsx(Z,{title:"URL Scanner",description:"Scan any URL for phishing, malware delivery, and abuse. A static fast pass plus a headless-browser deep pass with screenshots, captured requests, and SSRF-locked egress.",canonicalPath:"/scan"}),e.jsxs("div",{className:"mb-6 text-center",children:[e.jsxs("h1",{className:"flex items-center justify-center gap-2 text-4xl font-bold tracking-tight text-text-primary",children:[e.jsx("span",{className:"text-accent-500",children:e.jsx(xe,{size:30})}),"Scan a URL"]}),e.jsx("p",{className:"mx-auto mt-3 max-w-2xl text-text-secondary",children:"A sub-second static fast pass (headers, TLS, favicon, redirect chain, resources, verdict) with SSRF-locked egress, automatic sensitive-URL scrubbing, brand/phishing-kit detection, homograph checks, and an explainable verdict. The headless-browser deep pass (screenshot/DOM/network) runs when a browser worker is attached."})]}),e.jsx("div",{className:"mb-4 flex flex-wrap gap-1.5",role:"group","aria-label":"Scan mode",children:[["single","Single URL"],["bulk","Bulk / file"],["search","Search scans"]].map(([c,g])=>e.jsx("button",{type:"button","aria-pressed":j===c,onClick:()=>U(c),className:`rounded-full border px-3 py-1 text-xs transition-colors ${j===c?"border-accent-500 bg-accent-500/10 text-accent-500":"border-border-default text-text-muted hover:text-text-primary"}`,children:g},c))}),j==="bulk"&&e.jsx(Le,{authed:t}),j==="search"&&e.jsx(be,{}),j==="single"&&e.jsxs("div",{className:"rounded-xl border border-border-default bg-bg-raised p-5",children:[e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row",children:[e.jsx("input",{value:r,onChange:c=>u(c.target.value),onKeyDown:c=>{c.key==="Enter"&&I()},placeholder:"https://suspicious.example/login",className:"flex-1 rounded-md border border-border-default bg-bg-base px-3 py-2 font-mono text-sm text-text-primary outline-none focus:border-accent-500"}),e.jsx(te,{onClick:()=>void I(),disabled:m==="scanning",children:m==="scanning"?"Scanningâ¦":"Scan"})]}),e.jsxs("div",{className:"mt-3 grid grid-cols-1 gap-3 sm:grid-cols-3",children:[e.jsxs("label",{className:"text-xs font-medium text-text-muted",children:["Depth",e.jsxs("select",{value:k,onChange:c=>v(c.target.value),className:"mt-1 w-full rounded-md border border-border-default bg-bg-base px-3 py-2 text-sm text-text-primary outline-none focus:border-accent-500",children:[e.jsx("option",{value:"fast",children:"Fast (static, sub-second)"}),e.jsx("option",{value:"standard",children:"Standard (full render)"}),e.jsx("option",{value:"deep",children:"Deep (multi-vantage + files)"})]})]}),e.jsxs("label",{className:"text-xs font-medium text-text-muted",children:["Visibility",e.jsxs("select",{value:t?f:"public",disabled:!t,onChange:c=>P(c.target.value),className:"mt-1 w-full rounded-md border border-border-default bg-bg-base px-3 py-2 text-sm text-text-primary outline-none focus:border-accent-500 disabled:opacity-50",children:[e.jsx("option",{value:"private",children:"Private (account)"}),e.jsx("option",{value:"public",children:"Public (shareable)"})]})]}),e.jsx("div",{className:"flex items-end text-xs text-text-muted",children:e.jsxs("span",{className:"inline-flex items-center gap-1",children:[e.jsx(me,{size:14})," Private-by-default · secrets auto-scrubbed"]})})]}),$&&e.jsx("p",{className:"mt-3 text-sm text-status-danger",children:$})]}),b&&j!=="search"&&e.jsx(Ne,{result:b}),j==="single"&&m==="idle"&&!b&&A.length>0&&e.jsxs("div",{className:"mt-6 rounded-xl border border-border-default bg-bg-raised p-5",children:[e.jsxs("div",{className:"mb-3 flex items-center justify-between",children:[e.jsx("h2",{className:"text-sm font-semibold text-text-primary",children:"Recent public scans"}),e.jsxs("span",{className:"text-xs text-text-muted",children:[A.length," shown"]})]}),e.jsx("div",{className:"overflow-hidden rounded-md border border-border-subtle",children:e.jsxs("table",{className:"w-full text-left text-sm",children:[e.jsx("thead",{className:"bg-bg-overlay text-xs uppercase tracking-wide text-text-muted",children:e.jsxs("tr",{children:[e.jsx("th",{scope:"col",className:"px-3 py-2 font-medium",children:"URL"}),e.jsx("th",{scope:"col",className:"px-3 py-2 font-medium",children:"Verdict"}),e.jsx("th",{scope:"col",className:"hidden px-3 py-2 text-right font-medium sm:table-cell",children:"Score"}),e.jsx("th",{scope:"col",className:"px-3 py-2 text-right font-medium",children:"When"})]})}),e.jsx("tbody",{children:A.map(c=>{const g=Y(c.verdict);return e.jsxs("tr",{className:"border-t border-border-subtle hover:bg-bg-overlay/60",children:[e.jsxs("td",{className:"w-full max-w-0 px-3 py-2",children:[e.jsx(S,{to:q(c.uuid,c.hostname),className:"block truncate font-mono text-xs text-accent-500 hover:underline",title:c.url,children:c.hostname??c.url}),c.title&&e.jsx("span",{className:"block truncate text-xs text-text-muted",title:c.title,children:c.title})]}),e.jsx("td",{className:"px-3 py-2",children:e.jsx("span",{className:`inline-block rounded border px-1.5 py-0.5 text-micro font-semibold uppercase ${ie[g]} ${ne[g]}`,children:g})}),e.jsx("td",{className:"hidden px-3 py-2 text-right font-mono text-xs text-text-secondary sm:table-cell",children:c.score}),e.jsx("td",{className:"px-3 py-2 text-right text-xs text-text-muted",title:new Date(c.time).toLocaleStr
1ing(),children:pe(c.time)})]},c.uuid)})})]})}),e.jsx("p",{className:"mt-2 text-micro text-text-muted",children:"Public scans submitted across the platform. Private and unlisted scans are never listed here."})]})]})}function Ne({result:t}){var $,R,b,E,A,_,D,M,L,y,I,O,B,H;const a=ue(),i=t.verdicts,o=ne[Y(i.verdict)],n=ie[Y(i.verdict)],r=t.meta.capabilities,u=!!(r!=null&&r.deepPass),k=!!(r!=null&&r.deepPassQueued),v=!!t.partial||t.status==="queued"||t.status==="running"||t.status==="partial",f=typeof t.meta.timings.fastPassMs=="number"?`fast ${t.meta.timings.fastPassMs} ms`:null,P=typeof t.meta.timings.totalMs=="number"?`total ${t.meta.timings.totalMs} ms`:v?"total pending":null,j=f||P?[f,P].filter(Boolean).join(" · "):v?"measuringâ¦":void 0,[U,m]=p.useState([]);p.useEffect(()=>{if(t.status!=="done"&&!t.partial)return;let s=!1;return C.scanSimilar(t.uuid,8).then(d=>{s||m((d.matches??[]).slice(0,8).map(w=>({uuid:w.doc.uuid,pageUrl:w.doc.pageUrl,verdict:w.doc.verdict,score:w.doc.score,fused:w.fused,spaces:Object.keys(w.spaces??{})})))}).catch(()=>{}),()=>{s=!0}},[t.uuid,t.status,t.partial]);const h=t.intel.corpusHits.filter(s=>s.source==="cyble-botshield");return e.jsxs("div",{className:"mt-6 space-y-4",children:[t.partial&&e.jsxs("div",{className:"flex items-center gap-2 rounded-md border border-accent-500/30 bg-accent-500/10 px-3 py-2 text-sm text-text-primary","aria-live":"polite",children:[e.jsx("span",{className:"inline-block h-3 w-3 animate-spin rounded-full border-2 border-accent-500 border-t-transparent motion-reduce:animate-none"}),typeof t.meta.timings.firstSignalMs=="number"?`First signal in ${t.meta.timings.firstSignalMs} ms · deep pass + intel enrichment still runningâ¦`:"Fast-pass results below · deep pass + intel enrichment still runningâ¦"]}),e.jsxs("div",{className:`sticky top-14 z-20 rounded-xl border p-5 shadow-sm backdrop-blur supports-[backdrop-filter]:bg-bg-raised/95 lg:top-2 ${n}`,children:[e.jsxs("div",{className:"flex flex-wrap items-center justify-between gap-3",children:[e.jsxs("div",{children:[e.jsx("div",{className:`text-2xl font-bold uppercase ${o}`,children:i.verdict}),e.jsx("div",{className:"mt-1 break-all font-mono text-sm text-text-secondary",children:t.page.url})]}),e.jsxs("div",{className:"text-right",children:[e.jsx("div",{className:`text-3xl font-bold ${o}`,children:i.score>0?`+${i.score}`:i.score}),e.jsxs("div",{className:"text-xs text-text-muted",children:["score (â100â¦+100) · conf ",Math.round(i.confidence*100),"%"]})]})]}),e.jsxs("div",{className:"mt-3 flex flex-wrap gap-2",children:[i.brands.map(s=>e.jsx(F,{label:`brand: ${s}`,tone:"warn"},s)),i.categories.map(s=>e.jsx(F,{label:s,tone:"danger"},s)),(($=t.intel.kitFamily)==null?void 0:$.name)&&e.jsx(F,{label:`kit: ${t.intel.kitFamily.name}`,tone:"danger"}),t.meta.scrubbed&&e.jsx(F,{label:"secrets scrubbed â private",tone:"info"}),((R=t.intel.homograph)==null?void 0:R.isIdn)&&e.jsx(F,{label:"IDN / punycode",tone:"warn"})]}),e.jsxs("div",{className:"mt-3 grid grid-cols-3 gap-2 text-center text-xs",children:[e.jsx(G,{label:"Our engine",value:i.subscores.ourEngine}),e.jsx(G,{label:"Third-party",value:i.subscores.thirdParty}),e.jsx(G,{label:"Community",value:i.subscores.community})]}),e.jsxs("div",{className:"mt-3 flex flex-wrap items-center gap-3",children:[e.jsx(S,{to:`/agent?q=${encodeURIComponent(`Explain this MalwareAnalyzer URL scan of ${t.page.url}: verdict ${i.verdict} score ${i.score}. Cover ${a?"intel and third-party hits":"Cyble Vision / third-party hits"}, brands, phishing kit, and key signals.`)}`,className:"text-sm font-semibold text-accent-500 hover:underline",children:"Ask Agent to explain this scan â"}),e.jsxs("span",{className:"text-sm text-text-secondary",children:["Investigate:"," ",e.jsx(S,{to:`/graph?seed=${encodeURIComponent(`scan:${t.uuid}`)}`,className:"font-semibold text-accent-500 hover:underline",children:"this scan"}),t.page.domain?e.jsxs(e.Fragment,{children:[" · ",e.jsx(S,{to:`/graph?seed=${encodeURIComponent(`domain:${t.page.domain}`)}`,className:"font-semibold text-accent-500 hover:underline",children:"this domain"})]}):null]}),t.status!=="queued"&&t.status!=="running"&&e.jsx(fe,{url:s=>C.scanDocumentUrl(t.uuid,s),fileBase:`MalwareAnalyzer-scan-${(t.page.domain||t.uuid).replace(/[^a-zA-Z0-9._-]+/g,"-").slice(0,60)}`})]})]}),((b=t.evidence)==null?void 0:b.screenshotUrl)&&e.jsxs("div",{className:"overflow-hidden rounded-xl border border-border-subtle bg-bg-raised",children:[e.jsxs("div",{className:"flex items-center justify-between px-4 py-2 text-sm",children:[e.jsx("span",{className:"font-semibold text-text-primary",children:"Rendered screenshot (headless browser)"}),e.jsx("span",{className:"text-xs text-text-muted",children:typeof t.meta.timings.deepPassMs=="number"?`deep pass · ${t.meta.timings.deepPassMs} ms`:"deep pass"})]}),e.jsx("a",{href:t.evidence.screenshotUrl,target:"_blank",rel:"noreferrer",children:e.jsx("img",{src:t.evidence.screenshotUrl,alt:"Ren
1dered page screenshot",className:"max-h-[520px] w-full border-t border-border-subtle bg-white object-contain object-top",loading:"lazy"})})]}),(t.data.requests.length>0||t.stats.requests>0)&&e.jsx(Se,{result:t}),e.jsx(we,{result:t}),e.jsxs("div",{className:"grid grid-cols-1 gap-4 lg:grid-cols-2",children:[e.jsx(x,{title:"Why this verdict",children:i.signals.length===0?e.jsx("p",{className:"text-sm text-text-muted",children:"No signals fired."}):e.jsx("ul",{className:"space-y-1.5",children:i.signals.map(s=>e.jsxs("li",{className:"flex items-start justify-between gap-3 text-sm",children:[e.jsxs("span",{className:"text-text-secondary",children:[e.jsx("span",{className:"text-text-primary",children:s.label}),s.detail&&e.jsx("span",{className:"ml-1 block break-all font-mono text-xs text-text-muted",children:s.detail})]}),e.jsx("span",{className:`shrink-0 font-mono ${s.weight>=0?"text-verdict-malicious":"text-verdict-clean"}`,children:s.weight>=0?`+${s.weight}`:s.weight})]},s.id))})}),e.jsxs(x,{title:"Page",children:[e.jsx(l,{k:"IP",v:t.page.ip}),e.jsx(l,{k:"PTR",v:t.page.ptr}),e.jsx(l,{k:"ASN",v:t.page.asn?`${t.page.asn}${t.page.asnname?` · ${t.page.asnname}`:""}`:void 0}),e.jsx(l,{k:"Country",v:ee(t.page.country)}),e.jsx(l,{k:"Popularity rank",v:typeof t.page.umbrellaRank=="number"?`#${t.page.umbrellaRank.toLocaleString()} (Umbrella)`:void 0}),e.jsx(l,{k:"Server",v:t.page.server}),e.jsx(l,{k:"Status",v:t.page.status?String(t.page.status):void 0}),e.jsx(l,{k:"Title",v:t.page.title}),e.jsx(l,{k:"TLS issuer",v:t.page.tlsIssuer}),e.jsx(l,{k:"Redirects",v:String(t.meta.safety.redirectHops)}),e.jsx(l,{k:"Egress",v:t.meta.safety.egressLocked?`locked · pinned ${t.meta.safety.pinnedAddress??""}`:"open"}),e.jsx(l,{k:"Timing",v:j})]}),(((E=t.brandAssessments)==null?void 0:E.length)??0)>0&&e.jsx(x,{title:"Brand relationship",children:e.jsx("div",{className:"space-y-3",children:t.brandAssessments.filter(s=>s.relationship!=="unrelated").map(s=>e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"text-sm font-medium text-text-primary",children:s.label}),e.jsx("span",{className:`rounded border px-1.5 py-0.5 text-micro font-semibold uppercase ${ve[s.relationship]}`,children:je[s.relationship]}),e.jsxs("span",{className:"text-micro text-text-muted",children:[Math.round(s.confidence*100),"% confidence"]})]}),e.jsx("div",{className:"mt-1 flex flex-wrap gap-1",children:s.sources.map(d=>e.jsx("span",{className:"rounded bg-bg-inset px-1.5 py-0.5 text-micro text-text-secondary",children:d.replace(/-/g," ")},d))}),s.evidence.length>0&&e.jsx("ul",{className:"mt-1 space-y-0.5 text-xs text-text-muted",children:s.evidence.slice(0,4).map(d=>e.jsx("li",{children:d},d))}),s.relationship==="impersonating"&&e.jsxs(S,{to:`/search?tab=scans&q=${encodeURIComponent(`impersonates:${s.brand}`)}`,className:"mt-1 inline-block text-xs text-accent-500 hover:underline",children:["Every domain impersonating ",s.label," â"]})]},s.brand))})}),e.jsx(x,{title:"Site attribution",children:t.attribution?e.jsxs(e.Fragment,{children:[e.jsx(l,{k:"Operated by",v:t.attribution.operator?`${t.attribution.operator} (per ${t.attribution.operatorSource})`:"Not asserted - no verifiable owner"}),e.jsx(l,{k:"Certificate",v:ye[t.attribution.certAssurance]}),e.jsx(l,{k:"Certificate organization",v:t.attribution.certOrganization??"None named"}),e.jsx(l,{k:"Issued by",v:t.attribution.certIssuerOrganization}),e.jsx(l,{k:"Registrant",v:t.attribution.registrantOrganization??"Not published"}),e.jsx(l,{k:"Hosted on",v:t.attribution.networkOperator}),t.attribution.evidence.length>0&&e.jsx("ul",{className:"mt-2 space-y-1 border-t border-border-subtle pt-2 text-xs text-text-muted",children:t.attribution.evidence.map(s=>e.jsx("li",{children:s},s))})]}):e.jsx("p",{className:"text-sm text-text-muted",children:"Attribution was not computed for this scan (it predates the check, or the scan did not complete)."})}),e.jsx(x,{title:"WHOIS / domain registration",children:t.registration?e.jsxs(e.Fragment,{children:[e.jsx(l,{k:"Domain",v:t.registration.domain}),e.jsx(l,{k:"Registrar",v:t.registration.registrar}),e.jsx(l,{k:"Registered",v:t.registration.createdDate?`${t.registration.createdDate.slice(0,10)}${typeof t.registration.ageDays=="number"?` · ${t.registration.ageDays}d ago`:""}`:void 0}),e.jsx(l,{k:"Expires",v:(A=t.registration.expiresDate)==null?void 0:A.slice(0,10)}),e.jsx(l,{k:"Registrant country",v:ee(t.registration.registrantCountry)}),e.jsx(l,{k:"Nameservers",v:(_=t.registration.nameservers)==null?void 0:_.slice(0,4).join(", ")}),typeof t.registration.ageDays=="number"&&t.registration.ageDays<=30&&e.jsxs("div",{className:"mt-2 rounded border border-status-warning/40 bg-status-warning/10 px-2 py-1 text-xs text-text-secondary",children:["Recently registered domain (",t.registration.ageDays," days), a common phishing signal."]}
1),e.jsxs("div",{className:"mt-1 text-[10px] text-text-muted",children:["Source: ",t.registration.source.toUpperCase()]})]}):e.jsx("p",{className:"text-sm text-text-muted",children:"RDAP/WHOIS unavailable for this target (IP-literal host, an unsupported TLD, or the registry did not respond)."})}),t.evidence.domUrl&&e.jsxs(x,{title:"Captured DOM",children:[e.jsx("p",{className:"text-sm text-text-secondary",children:"The fully rendered page HTML captured during the scan."}),e.jsx("a",{href:t.evidence.domUrl,target:"_blank",rel:"noreferrer",className:"mt-2 inline-block rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong hover:underline",children:"View raw DOM (HTML) â"})]}),t.lists.certificates.length>0&&e.jsxs(x,{title:"TLS certificate",children:[e.jsx(l,{k:"Subject",v:t.lists.certificates[0].subject}),e.jsx(l,{k:"Issuer",v:t.lists.certificates[0].issuer}),e.jsx(l,{k:"Valid",v:`${(t.lists.certificates[0].validFrom||"").slice(0,10)} â ${(t.lists.certificates[0].validTo||"").slice(0,10)}`}),e.jsx(l,{k:"SHA-256",v:t.lists.certificates[0].fingerprintSha256}),e.jsx(l,{k:"Serial",v:t.lists.certificates[0].serialNumber}),t.lists.certificates[0].subjectAltNames.length>0&&e.jsxs("div",{className:"mt-2",children:[e.jsxs("div",{className:"mb-1 text-xs text-text-muted",children:["Subject alt names · ",t.lists.certificates[0].subjectAltNames.length]}),e.jsx("div",{className:"flex flex-wrap gap-1",children:t.lists.certificates[0].subjectAltNames.slice(0,24).map(s=>e.jsx("span",{className:"rounded bg-bg-inset px-1.5 py-0.5 font-mono text-xs text-text-secondary",children:s},s))})]})]}),e.jsxs(x,{title:`Domains (${t.lists.domains.length}) · IPs (${t.lists.ips.length})`,children:[e.jsx("div",{className:"flex flex-wrap gap-1.5",children:t.lists.domains.slice(0,40).map(s=>e.jsx("span",{className:"rounded bg-bg-inset px-2 py-0.5 font-mono text-xs text-text-secondary",children:s},s))}),e.jsx("div",{className:"mt-2 flex flex-wrap gap-1.5",children:t.lists.ips.slice(0,40).map(s=>e.jsx("span",{className:"rounded bg-bg-inset px-2 py-0.5 font-mono text-xs text-text-secondary",children:s},s))})]}),e.jsxs(x,{title:"Scan coverage",children:[e.jsx(l,{k:"Static fast pass",v:"ran"}),e.jsx(l,{k:"Dynamic deep pass",v:u?"ran (browser)":k?v?"running (queued on the browser fleet)â¦":"still processing server-side":r!=null&&r.deepPassAvailable?"available (did not run for this scan)":"did not run for this scan"}),e.jsx(l,{k:"Processors",v:t.meta.processors.join(", ")}),!u&&e.jsx("p",{className:"mt-2 rounded border border-border-subtle bg-bg-base/50 px-2 py-1 text-xs text-text-muted",children:k?v?"These are the static fast-pass results. The headless-browser deep pass (screenshot/DOM/network) is queued on the isolated browser fleet and this page will update when it lands.":"These are the static fast-pass results. The headless-browser deep pass (screenshot/DOM/network) was queued to the isolated browser fleet; revisit this result shortly for the enriched capture.":"This scan is the static fast pass (headers, TLS, favicon, redirect chain, resources, verdict). The headless-browser deep pass (screenshot/DOM/network) did not run for this scan."})]}),e.jsxs(x,{title:"Intel & artifacts",children:[e.jsx(l,{k:"Corpus hits",v:String(t.intel.corpusHits.length)}),e.jsx(l,{k:"Botshield hits",v:h.length?String(h.length):void 0}),e.jsx(l,{k:"Phishing kit",v:(D=t.intel.kitFamily)==null?void 0:D.name}),e.jsx(l,{k:"Actor",v:(M=t.intel.actor)==null?void 0:M.name}),e.jsx(l,{k:"Favicon mmh3",v:t.evidence.faviconMmh3!==void 0?String(t.evidence.faviconMmh3):void 0}),e.jsx(l,{k:"Certificates",v:String(t.lists.certificates.length)}),h.length>0&&e.jsx("ul",{className:"mt-2 space-y-1",children:h.slice(0,6).map(s=>e.jsxs("li",{className:"font-mono text-xs text-text-secondary",children:[s.indicator,": ",s.note]},`${s.indicator}-${s.note}`))}),t.evidence.domUrl&&e.jsx("a",{href:t.evidence.domUrl,target:"_blank",rel:"noreferrer",className:"mt-2 block text-xs text-accent-400 hover:underline",children:"View captured DOM (rendered HTML) â"}),t.status==="done"&&t.task.visibility!=="private"&&e.jsx("a",{href:C.scanStixUrl(t.uuid),target:"_blank",rel:"noreferrer",className:"mt-2 inline-block text-xs text-accent-400 hover:underline",children:"Export STIX 2.1 bundle â"}),t.meta.scrubbed&&e.jsx("p",{className:"mt-2 rounded border border-status-warning/40 bg-status-warning/10 px-2 py-1 text-xs text-text-secondary",children:"Sensitive tokens detected. This scan was forced private and the sensitive components were redacted before storage."})]}),U.length>0&&e.jsx(x,{title:`Similar scans (${U.length})`,children:e.jsx("ul",{className:"space-y-2",children:U.map(s=>e.jsxs("li",{className:"text-sm",children:[e.jsxs(S,{to:q(s.uuid,se(s.pageUrl)),className:"font-medium text-accent-400 hover:underline",children:[s.verdict," · ",s.score>0?`+${s.score}`:s.score]}),e.jsx("div",{className:"break-all font-mono text-xs text-text-muted",children:s.pageUrl}),e.jsxs("div",{className:"text-xs text-text-muted",children:["match via ",s.space
1s.join(", ")||"infra"," · fused ",s.fused.toFixed(1)]})]},s.uuid))})}),t.data.downloads.length>0&&e.jsx(x,{title:`Grabbed files (${t.data.downloads.length})`,children:e.jsx("ul",{className:"space-y-1.5",children:t.data.downloads.map((s,d)=>e.jsxs("li",{className:"text-sm",children:[e.jsx("span",{className:"text-text-primary",children:s.filename??"file"}),s.quarantined?e.jsx("span",{className:"ml-2 rounded bg-verdict-malicious/15 px-1.5 py-0.5 text-xs text-verdict-malicious",children:"quarantined"}):s.sandboxTaskId?e.jsx("span",{className:"ml-2 rounded bg-accent-500/15 px-1.5 py-0.5 text-xs text-accent-400",children:"routed to sandbox"}):null,s.sha256&&e.jsx("span",{className:"ml-1 block break-all font-mono text-xs text-text-muted",children:s.sha256})]},d))})}),t.data.qrCodes.length>0&&e.jsx(x,{title:`QR codes decoded (${t.data.qrCodes.length})`,children:e.jsx("ul",{className:"space-y-1.5",children:t.data.qrCodes.map((s,d)=>e.jsxs("li",{className:"break-all font-mono text-xs text-text-secondary",children:[s.isUrl?"ð ":"",s.data]},d))})}),t.data.cookies.length>0&&e.jsx(x,{title:`Cookies (${t.data.cookies.length})`,children:e.jsx("ul",{className:"space-y-1.5",children:t.data.cookies.slice(0,30).map((s,d)=>e.jsxs("li",{className:"text-sm",children:[e.jsx("span",{className:"font-mono text-text-primary",children:s.name}),e.jsxs("span",{className:"ml-2 font-mono text-xs text-text-muted",children:[s.domain,s.path&&s.path!=="/"?s.path:""]}),e.jsxs("span",{className:"ml-2 inline-flex flex-wrap gap-1 align-middle",children:[s.httpOnly&&e.jsx("span",{className:"rounded bg-bg-inset px-1 py-0.5 text-micro text-text-muted",children:"HttpOnly"}),s.secure&&e.jsx("span",{className:"rounded bg-bg-inset px-1 py-0.5 text-micro text-text-muted",children:"Secure"}),s.sameSite&&e.jsxs("span",{className:"rounded bg-bg-inset px-1 py-0.5 text-micro text-text-muted",children:["SameSite=",s.sameSite]})]}),s.value&&e.jsx("span",{className:"mt-0.5 block break-all font-mono text-micro text-text-muted",children:s.value.slice(0,80)})]},d))})}),t.data.console.length>0&&e.jsx(x,{title:`Console messages (${t.data.console.length})`,children:e.jsx("ul",{className:"space-y-1",children:t.data.console.slice(0,40).map((s,d)=>e.jsxs("li",{className:"text-xs",children:[e.jsx("span",{className:`mr-2 rounded px-1 py-0.5 font-semibold uppercase ${s.level==="error"?"bg-verdict-malicious/15 text-verdict-malicious":s.level==="warning"||s.level==="warn"?"bg-verdict-suspicious/15 text-verdict-suspicious":"bg-bg-inset text-text-muted"}`,children:s.level}),e.jsx("span",{className:"break-all font-mono text-text-secondary",children:s.text}),s.url&&e.jsxs("span",{className:"mt-0.5 block break-all font-mono text-micro text-text-muted",children:[s.url,typeof s.line=="number"?`:${s.line}`:""]})]},d))})}),(((L=t.data.globals)==null?void 0:L.length)??0)>0&&e.jsxs(x,{title:`JavaScript window variables (${t.data.globals.length})`,children:[e.jsx("p",{className:"mb-2 text-xs text-text-muted",children:"Non-standard globals defined on the page window; helpful for fingerprinting client-side frameworks and code."}),e.jsx("div",{className:"flex flex-wrap gap-1",children:t.data.globals.slice(0,80).map(s=>e.jsx("span",{className:"rounded bg-bg-inset px-1.5 py-0.5 font-mono text-xs text-text-secondary",children:s},s))})]}),t.data.links.length>0&&e.jsx(x,{title:`Outgoing links (${t.data.links.length})`,children:e.jsx("ul",{className:"space-y-1",children:t.data.links.slice(0,30).map((s,d)=>e.jsxs("li",{className:"text-xs",children:[e.jsx("span",{className:"break-all font-mono text-text-secondary",title:s.href,children:s.href}),s.text&&e.jsxs("span",{className:"ml-1 text-text-muted",children:["- ",s.text.slice(0,60)]})]},d))})}),(((y=t.data.websockets)==null?void 0:y.length)??0)>0&&e.jsx(x,{title:`WebSocket endpoints (${t.data.websockets.length})`,children:e.jsx("ul",{className:"space-y-1",children:t.data.websockets.slice(0,20).map((s,d)=>e.jsx("li",{className:"break-all font-mono text-xs text-text-secondary",children:s},d))})}),(((I=t.page.urlHistory)==null?void 0:I.length)??0)>1&&e.jsx(x,{title:`Page URL history (${t.page.urlHistory.length})`,children:e.jsx("ol",{className:"space-y-1",children:t.page.urlHistory.map((s,d)=>e.jsxs("li",{className:"flex items-start gap-2 text-xs",children:[e.jsx("span",{className:`shrink-0 rounded px-1 py-0.5 font-mono ${s.status>=400?"bg-verdict-malicious/15 text-verdict-malicious":s.status>=300?"bg-verdict-suspicious/15 text-verdict-suspicious":"bg-bg-inset text-text-muted"}`,children:s.status||"-"}),e.jsx("span",{className:"break-all font-mono text-text-secondary",children:s.url})]},d))})}),t.page.responseHeaders&&Object.keys(t.page.responseHeaders).length>0&&e.jsx(x,{title:"Response headers",children:e.jsx("ul",{className:"space-y-0.5",children:Object.entries(t.page.responseHeaders).map(([s,d])=>e.jsxs("li",{className:"flex gap-2 text-xs",children:[e.jsxs("span",{className:"shrink-0 font-mono text-text-muted",children:[s,":"]}),e.jsx("span",{className:"break-all font-mono text-text-secondary",children:d})]},s))})}),t.correlations&&t.correlations.samples.length>0&&e.jsx(De,{correlations:t.correlations}),(((O=t.data.ipDetails)==null?void 0:O.length)??0)>0&&e.jsxs(x,{title:`Contacted IPs (${t.data.ipDetails.length})`,children:[e.jsx("div",{className:"overflow-x-auto",children:e.jsx("table",{className:"w-full text-left text-xs",children:e.jsx("tbody",{children:t.data.ipDetails.map(s=>{const d=s.abuseConfidenceScore;return e.jsxs("tr",{className:"border-b border-border-subtle/50 last:border-0",children:[e.jsx("td",{className:"py-1 pr-2 font-mono text-text-primary",children:s.ip}),e.jsx("td",{className:"py-1 pr-2",children:s.countryCode?e.jsx(ae,{code:s.countryCode,name:s.countryName}):null}),e.jsx("td",{className:"py-1 pr-2 text-text-muted",children:[s.asn,s.asOrg].filter(
1Boolean).join(" · ")}),e.jsx("td",{className:"py-1 text-right",children:d!==void 0&&d>=25?e.jsxs("span",{className:`rounded border px-1.5 py-0.5 text-micro font-semibold ${d>=75?"border-verdict-malicious/40 bg-verdict-malicious/10 text-verdict-malicious":"border-verdict-suspicious/40 bg-verdict-suspicious/10 text-verdict-suspicious"}`,title:`AbuseIPDB${s.abuseTotalReports!==void 0?` · ${s.abuseTotalReports} reports`:""}${s.abuseUsageType?` · ${s.abuseUsageType}`:""}`,children:["Abuse ",d,"%"]}):s.isTor?e.jsx("span",{className:"rounded border border-border-subtle bg-bg-overlay px-1.5 py-0.5 text-micro text-text-secondary",children:"Tor"}):null})]},s.ip)})})})}),e.jsx("p",{className:"mt-2 text-micro text-text-muted",children:"Registration/geolocation + AbuseIPDB reputation per contacted IP."})]}),(((B=t.data.technologies)==null?void 0:B.length)??0)>0&&e.jsxs(x,{title:`Technologies (${t.data.technologies.length})`,children:[e.jsx("div",{className:"flex flex-wrap gap-1.5",children:t.data.technologies.map(s=>e.jsxs("span",{className:"rounded bg-bg-inset px-2 py-0.5 text-xs text-text-secondary",title:s.category,children:[s.name,s.category?e.jsxs("span",{className:"ml-1 text-text-muted",children:["· ",s.category]}):null]},s.name))}),e.jsx("p",{className:"mt-2 text-micro text-text-muted",children:"Best-effort fingerprint from response headers and page markers."})]}),(((H=t.data.frames)==null?void 0:H.length)??0)>0&&e.jsx(x,{title:`Frames (${t.data.frames.length})`,children:e.jsx("ul",{className:"space-y-1",children:t.data.frames.slice(0,30).map((s,d)=>e.jsxs("li",{className:"break-all font-mono text-xs text-text-secondary",children:[s.url,s.name?` · ${s.name}`:""]},d))})}),e.jsx(Te,{intel:t.intel}),e.jsx(Ce,{result:t}),e.jsx(Pe,{result:t})]}),t.data.requests.length>0&&e.jsx(Re,{requests:t.data.requests})]})}function ke(t){switch(t){case"av":return"antivirus";case"vendor-av":return"vendor antivirus";case"yara":return"yara rule";case"hash":return"hash reputation";default:return t}}function we({result:t}){const a=t.engineStats,i=t.engines??[];if(!a&&!t.enginesDegraded)return null;const o=i.filter(r=>r.flagged),n=((a==null?void 0:a.total)??0)>0&&((a==null?void 0:a.scanned)??0)>0;return e.jsx("div",{className:"mt-4",children:e.jsx(x,{title:n?`Antivirus & YARA - ${a.flagged} of ${a.total} engines flagged`:"Antivirus & YARA",children:n?e.jsxs(e.Fragment,{children:[e.jsxs("p",{className:"mb-2 text-xs text-text-muted",children:[a.targets," ",a.targets===1?"item":"items"," scanned (page content, its scripts, and any file the URL served) with the same engines a file report uses."]}),o.length===0?e.jsx("p",{className:"text-sm text-verdict-clean",children:"No engine flagged this page's content."}):o.every(r=>r.target!=="download")&&!t.verdicts.malicious?e.jsx("p",{className:"mb-2 text-xs text-text-muted",children:"Matched in page text. Pages that quote or document malware can match these signatures, so on their own they do not make a page malicious."}):null,o.length>0&&e.jsx("ul",{className:"space-y-1",children:o.slice(0,30).map(r=>e.jsxs("li",{className:"flex items-start justify-between gap-3 text-sm",children:[e.jsxs("span",{className:"text-text-primary",children:[r.engine,e.jsxs("span",{className:"ml-1.5 text-micro uppercase text-text-muted",children:[ke(r.category)," · ",r.target==="download"?"served file":"page content"]})]}),e.jsx("span",{className:`shrink-0 break-all font-mono text-xs ${r.target==="download"||t.verdicts.malicious?"text-verdict-malicious":"text-verdict-suspicious"}`,children:r.malwareName??"flagged"})]},r.source))})]}):e.jsx("p",{className:"text-sm text-verdict-suspicious",children:"The engine tier did not run for this scan, so its content is unjudged rather than clean."})})})}function Se({result:t}){const a=t.stats,i=[{label:"Requests",value:a.requests||t.data.requests.length},{label:"Domains",value:a.uniqDomains||t.lists.domains.length},{label:"IPs",value:a.uniqIps||t.lists.ips.length},{label:"Countries",value:a.uniqCountries??0},{label:"HTTPS",value:`${a.securePercentage??0}%`},{label:"Cookies",value:t.data.cookies.length},{label:"Links",value:t.data.links.length}];return e.jsx("div",{className:"grid grid-cols-3 gap-2 sm:grid-cols-4 lg:grid-cols-7",children:i.map(o=>e.jsxs("div",{className:"rounded-lg border border-border-subtle bg-bg-raised px-3 py-2 text-center",children:[e.jsx("div",{className:"font-mono text-lg font-bold text-text-primary",children:o.value}),e.jsx("div",{className:"text-micro uppercase tracking-wide text-text-muted",children:o.label})]},o.label))})}const $e=["all","document","script","stylesheet","image","xhr","fetch","font","other"];function Re({requests:t}){const[a,i]=p.useState("all"),o=a==="all"?t:t.filter(n=>
1(n.type??"other")===a);return e.jsxs("div",{className:"rounded-xl border border-border-subtle bg-bg-raised p-4",children:[e.jsxs("div",{className:"mb-3 flex flex-wrap items-center justify-between gap-2",children:[e.jsxs("h3",{className:"text-sm font-semibold text-text-primary",children:["HTTP transactions (",t.length,")"]}),e.jsx("div",{className:"flex flex-wrap gap-1",children:$e.map(n=>e.jsx("button",{onClick:()=>i(n),className:`rounded px-2 py-0.5 text-xs ${a===n?"bg-accent-500/20 text-accent-400":"bg-bg-inset text-text-muted hover:text-text-secondary"}`,children:n},n))})]}),e.jsx("div",{className:"overflow-x-auto rounded-md border border-border-subtle",children:e.jsxs("table",{className:"w-full text-left text-xs",children:[e.jsx("thead",{className:"bg-bg-overlay uppercase tracking-wide text-text-muted",children:e.jsxs("tr",{children:[e.jsx("th",{scope:"col",className:"px-2 py-1.5 font-medium",children:"Method"}),e.jsx("th",{scope:"col",className:"px-2 py-1.5 font-medium",children:"Status"}),e.jsx("th",{scope:"col",className:"px-2 py-1.5 font-medium",children:"Type"}),e.jsx("th",{scope:"col",className:"hidden px-2 py-1.5 font-medium sm:table-cell",children:"Server IP"}),e.jsx("th",{scope:"col",className:"px-2 py-1.5 font-medium",children:"URL"})]})}),e.jsx("tbody",{children:o.slice(0,300).map((n,r)=>e.jsxs("tr",{className:"border-t border-border-subtle/60 align-top",children:[e.jsx("td",{className:"px-2 py-1.5 font-mono",children:n.method}),e.jsx("td",{className:`px-2 py-1.5 font-mono ${n.status>=400?"text-verdict-malicious":n.status>=300?"text-verdict-suspicious":"text-text-secondary"}`,children:n.status||"-"}),e.jsx("td",{className:"px-2 py-1.5 text-text-muted",children:n.type??""}),e.jsx("td",{className:"hidden px-2 py-1.5 font-mono text-text-muted sm:table-cell",children:n.ip??""}),e.jsxs("td",{className:"px-2 py-1.5",children:[e.jsx("span",{className:"block break-all font-mono text-text-secondary",title:n.url,children:n.url}),(n.mimeType||n.hash||n.server)&&e.jsxs("span",{className:"text-micro text-text-muted",children:[[n.server,n.mimeType].filter(Boolean).join(" · "),n.hash?`${n.server||n.mimeType?" · ":""}${n.hash.slice(0,16)}â¦`:""]})]})]},r))})]})}),o.length>300&&e.jsxs("p",{className:"mt-2 text-micro text-text-muted",children:["Showing the first 300 of ",o.length," transactions."]})]})}function Te({intel:t}){const a=t.pdns??[],i=t.ctPivots??[],o=t.infraCluster,n=t.homograph;return a.length===0&&i.length===0&&!o&&!(n!=null&&n.isIdn)?null:e.jsxs(x,{title:"Threat-graph pivots",children:[o&&e.jsx(l,{k:"Infra cluster",v:`${o.id} · conf ${Math.round(o.confidence*100)}%`}),(n==null?void 0:n.isIdn)&&e.jsx(l,{k:"Homograph",v:`${n.skeleton}${n.brandMatch?` ~ ${n.brandMatch.brand}`:""}`}),a.length>0&&e.jsxs("div",{className:"mt-2",children:[e.jsx("div",{className:"mb-1 text-xs text-text-muted",children:"Passive DNS (shared IP)"}),a.slice(0,6).map(r=>e.jsxs("div",{className:"break-all font-mono text-xs text-text-secondary",children:[r.indicator," â ",r.records.slice(0,4).map(u=>u.value).join(", ")]},r.indicator))]}),i.length>0&&e.jsxs("div",{className:"mt-2",children:[e.jsx("div",{className:"mb-1 text-xs text-text-muted",children:"Shared-certificate siblings (CT)"}),i.slice(0,6).map(r=>{var u;return e.jsxs("div",{className:"break-all font-mono text-xs text-text-secondary",children:[r.indicator,(u=r.siblingDomains)!=null&&u.length?` â ${r.siblingDomains.slice(0,4).join(", ")}`:""]},r.indicator)})]}),e.jsx("p",{className:"mt-2 text-micro text-text-muted",children:"Pivots from the MalwareAnalyzer corpus (passive DNS / certificate transparency), not a global sensor network."})]})}function Ce({result:t}){const a=t.page.ip,i=t.page.domain,o=t.page.url;if(!a&&!i)return null;const n=a?[["VirusTotal",`https://www.virustotal.com/gui/ip-address/${a}`],["AbuseIPDB",`https://www.abuseipdb.com/check/${a}`],["Shodan",`https://www.shodan.io/host/${a}`],["Censys",`https://search.censys.io/hosts/${a}`],["ipinfo",`https://ipinfo.io/${a}`]]:[],r=i?[["VirusTotal",`https://www.virustotal.com/gui/domain/${i}`],["crt.sh",`https://crt.sh/?q=${encodeURIComponent(i)}`],["SecurityTrails",`https://securitytrails.com/domain/${i}/dns`],["Safe Browsing",`https://transparencyreport.google.com/safe-browsing/search?url=${encodeURIComponent(i)}`]]:[],u=o?[["Archive.org",`https://web.archive.org/web/*/${o}`]]:[];return e.jsxs(x,{title:"External lookups",children:[a&&e.jsx(W,{label:`IP ${a}`,links:n}),i&&e.jsx(W,{label:`Domain ${i}`,links:r}),o&&e.jsx(W,{label:"URL",links:u}),e.jsx("p",{className:"mt-2 text-micro text-text-muted",children:"Pivot this indicator into third-party intelligence sources (opens in a new tab)."})]})}function W({label:t,links:a}){return a.length===0?null:e.jsxs("div",{className:"border-b border-border-subtle/50 py-1.5 last:border-0",children:[e.jsx("div",{className:"mb-1 break-all font-mono text-xs text-text-muted",children:t}),e.jsx("div",{className:"flex flex-wrap gap-1.5",children:a.map(([i,o])=>e.jsx("a",{href:o,target:"_blank",rel:"noreferrer noopener",className:"rounded border border-border-default px-2 py-0.5 text-xs text-accent-400 hover:border-border-strong hover:underline",children:i},i))})]})}function Pe({result:t}){const a=[...new Set([...t.lists.domains,...t.lists.ips,...t.lists.hashes])];if(a.length===0)return null;const i=a.join(` 2`),o=(n,r,u="text/plain")=>ge(new Blob([r],{type:u}),n);return e.jsxs(x,{title:`Indicators (${a.length})`,children:[e.jsx("p",{className:"mb-2 text-xs text-text-muted",children:"Domains, IPs, and resource hashes observed. This does not imply that any indicate malicious activity."}),e.jsx("pre",{className:"max-h-48 overflow-auto rounded bg-bg-inset p-2 font-mono text-xs text-text-secondary",children:i}),e.jsxs("div",{className:"mt-2 flex flex-wrap gap-2",children:[e.jsx("button",{onClick:()=>{var n;return(n=navigator.clipboard)==null?void 0:n.writeText(i)},className:"rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong",children:"Copy IOCs"}),e.jsx("button",{onClick:()=>o(`iocs-${t.uuid}.txt`,i),className:"rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong",children:"Download IOCs"}),e.jsx("button",{onClick:()=>o(`scan-${t.uuid}.json`,JSON.stringify(t,null,2),"application/json"),className:"rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong",children:"Download JSON"}),t.evidence.harUrl&&e.jsx("a",{href:t.evidence.harUrl,target:"_blank",rel:"noreferrer",className:"rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong hover:underline",children:"Download HAR"}),t.status==="done"&&t.task.visibility!=="private"&&e.jsx("a",{href:C.scanStixUrl(t.uuid),target:"_blank",rel:"noreferrer",className:"rounded border border-border-default px-2 py-1 text-xs text-accent-400 hover:border-border-strong hover:underline",children:"Export STIX 2.1"})]})]})}function G({label:t,value:a}){return e.jsxs("div",{className:"rounded-md bg-bg-base/50 px-2 py-1.5",children:[e.jsx("div",{className:`font-mono text-lg ${a>20?"text-verdict-malicious":a<-10?"text-verdict-clean":"text-text-secondary"}`,children:a>0?`+${a}`:a}),e.jsx("div",{className:"text-text-muted",children:t})]})}function x({title:t,children:a}){return e.jsxs("div",{className:"rounded-xl border border-border-subtle bg-bg-raised p-4",children:[e.jsx("h3",{className:"mb-3 text-sm font-semibold text-text-primary",children:t}),a]})}function l({k:t,v:a}){return a?e.jsxs("div",{className:"flex justify-between gap-3 border-b border-border-subtle/50 py-1 text-sm last:border-0",children:[e.jsx("span",{className:"text-text-muted",children:t}),e.jsx("span",{className:"break-all text-right font-mono text-xs text-text-secondary",children:a})]}):null}function ee(t){const a=t==null?void 0:t.trim();if(a)return/^[A-Za-z]{2}$/.test(a)?e.jsx(ae,{code:a}):a}function F({label:t,tone:a}){const i=a==="danger"?"bg-verdict-malicious/15 text-verdict-malicious":a==="warn"?"bg-verdict-suspicious/15 text-verdict-suspicious":"bg-
2accent-500/15 text-accent-400";return e.jsx("span",{className:`rounded px-2 py-0.5 text-xs font-medium ${i}`,children:t})}const Ue={c2:"C2 / config",config:"config",download:"payload host",contacted:"contacted",referenced:"referenced",dns:"DNS"};function De({correlations:t}){const a=t.samples.length,i=t.samples.filter(n=>n.hosting).length,o=t.samples.some(n=>n.family);return e.jsxs(x,{title:`Correlated malware (${t.total})`,children:[t.hosting&&e.jsx("p",{className:"mb-2 rounded border border-verdict-malicious/40 bg-verdict-malicious/10 px-2 py-1 text-xs text-verdict-malicious",children:"This URL hosts payload/config for known malware, which raised its verdict."}),e.jsx("div",{className:"max-h-96 overflow-y-auto",children:e.jsxs("table",{className:"w-full table-fixed text-left text-xs",children:[e.jsx("thead",{className:"sticky top-0 bg-bg-raised text-micro uppercase tracking-wide text-text-muted",children:e.jsxs("tr",{children:[e.jsx("th",{scope:"col",className:"w-full py-1 pr-2 font-medium",children:"Sample"}),o&&e.jsx("th",{scope:"col",className:"w-24 py-1 pr-2 font-medium",children:"Family"}),e.jsx("th",{scope:"col",className:"w-24 py-1 text-right font-medium",children:"Relation"})]})}),e.jsx("tbody",{children:t.samples.map(n=>e.jsxs("tr",{className:"border-b border-border-subtle/50 last:border-0",children:[e.jsx("td",{className:"w-full max-w-0 py-1 pr-2",children:e.jsx(S,{to:`/report/${n.sha256}`,className:"block truncate font-mono text-accent-500 hover:underline",title:n.name?`${n.name} 3${n.sha256}`:n.sha256,children:n.name??n.sha256})}),o&&e.jsx("td",{className:"w-24 truncate py-1 pr-2 text-text-muted",title:n.family??"",children:n.family??""}),e.jsx("td",{className:"w-24 py-1 text-right",children:n.hosting?e.jsx("span",{className:"rounded border border-verdict-malicious/40 bg-verdict-malicious/10 px-1.5 py-0.5 text-micro font-semibold text-verdict-malicious",children:"hosting"}):e.jsx("span",{className:"text-micro text-text-muted",children:Ue[n.edgeKind]??n.edgeKind})})]},n.sha256))})]})}),e.jsxs("p",{className:"mt-2 text-micro text-text-muted",children:[a<t.total?`Showing the ${a} most recent of ${t.total} correlated samples`:`${a} correlated ${a===1?"sample":"samples"}`,i>0?`; ${i} of them host payload/config here.`:"."," Malware samples that communicate to this URL/domain. Association is mapping/ontology only; only a sample that marks the URL as hosting payload/config affects the verdict."]})]})}function Le({authed:t}){const[a,i]=p.useState(""),[o,n]=p.useState("fast"),[r,u]=p.useState(!1),[k,v]=p.useState(null),[f,P]=p.useState(null),j=async m=>{if(m)try{const h=await m.text();i($=>$.trim()?`${$} 4${h}`:h)}catch{v("Could not read that file.")}},U=async()=>{if(a.trim()){u(!0),v(null),P(null);try{const{data:m}=await C.scanBatch({text:a,tier:o,visibility:"public"});P(m)}catch(m){v(K(m))}finally{u(!1)}}};return e.jsxs("div",{className:"rounded-xl border border-border-default bg-bg-raised p-5",children:[e.jsxs("p",{className:"mb-3 text-sm text-text-secondary",children:["Paste many URLs (one per line) or upload a file (.txt/.csv/.json). Domains become"," ",e.jsx("code",{className:"text-xs",children:"https://domain/"}),". Bulk runs the fast static pass so a large batch never overloads the browser fleet; open any result to run a full render."]}),e.jsx("textarea",{value:a,onChange:m=>i(m.target.value),rows:8,spellCheck:!1,placeholder:`https://evil.example/login 5bad-domain.tld 6https://another.example/pay`,className:"w-full rounded-md border border-border-default bg-bg-base px-3 py-2 font-mono text-xs text-text-primary outline-none focus:border-accent-500"}),e.jsxs("div",{className:"mt-3 flex flex-wrap items-center gap-3",children:[e.jsx("input",{type:"file",accept:".txt,.csv,.json,.md,.log,text/plain",onChange:m=>{var h;return void j((h=m.target.files)==null?void 0:h[0])},className:"text-xs text-text-muted file:mr-2 file:rounded file:border file:border-border-default file:bg-bg-base file:px-2 file:py-1 file:text-xs file:text-text-primary"}),e.jsxs("label",{className:"text-xs text-text-muted",children:["Depth"," ",e.jsxs("select",{value:o,onChange:m=>n(m.target.value),disabled:!t,className:"ml-1 rounded-md border border-border-default bg-bg-base px-2 py-1 text-xs text-text-primary outline-none focus:border-accent-500 disabled:opacity-50",children:[e.jsx("option",{value:"fast",children:"Fast (static)"}),e.jsxs("option",{value:"standard",children:["Standard (render)",t?"":" - sign in"]})]})]}),e.jsx(te,{onClick:()=>
6void U(),disabled:r||!a.trim(),children:r?"Submittingâ¦":"Scan all"})]}),k&&e.jsx("p",{className:"mt-3 text-sm text-status-danger",children:k}),f&&e.jsxs("div",{className:"mt-4 rounded-md border border-border-subtle bg-bg-overlay/50 p-3",children:[e.jsxs("p",{className:"text-sm text-text-primary",children:["Submitted ",f.submitted," of ",f.candidates," URL",f.candidates===1?"":"s",f.truncated?" (batch cap reached)":"",". Watch them on the"," ",e.jsx(S,{to:"/firehose",className:"text-accent-500 hover:underline",children:"Firehose (URLs)"}),"."]}),e.jsx("ul",{className:"mt-2 max-h-64 space-y-1 overflow-y-auto",children:f.jobs.map(m=>e.jsx("li",{className:"truncate text-xs",children:e.jsx(S,{to:q(m.uuid,se(m.url)),className:"font-mono text-accent-500 hover:underline",title:m.url,children:m.url})},m.uuid))})]})]})}export{Oe as ScanPage}; 7//# sourceMappingURL=ScanPage-B1icuoAI.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.