1import{x as G,j as e,f as b,y as Ve,A as Z,d as ee,r as j,z as Ke,i as Be,l as He,q as Je,s as y,L as $,c as ge,F as Ge,G as fe,b as We,I as Xe,X as Qe,E as Ye}from"./index-C86sjUM7.js";import{c as L}from"./runPresentation-DoqGxX4m.js";import{S as be,a as Ze}from"./shield-x-CWkSTwZs.js";import{S as H}from"./shield-alert-cz1iZj9B.js";import{L as se}from"./link-2-CKxS_3iO.js";import{I as J}from"./info-D5zhcT7u.js";import{R as z}from"./ReportEvidenceSection-Cpyz9tsY.js";import{u as es}from"./reportNavigation-B2CPzqI6.js";import{f as ss,n as as}from"./urlDetonation-Dm30FDJU.js";import{D as ts}from"./download-BjVXJSVp.js";import{F as is}from"./funnel-DKwgPUsk.js";import{S as je}from"./search-C0pTPwzI.js";import{C as ns}from"./clock-D-xVB89G.js";import{U as ls}from"./user-x-Cri30fGj.js";const rs=[["path",{d:"M12 6v16",key:"nqf5sj"}],["path",{d:"m19 13 2-1a9 9 0 0 1-18 0l2 1",key:"y7qv08"}],["path",{d:"M9 11h6",key:"1fldmi"}],["circle",{cx:"12",cy:"4",r:"2",key:"muu5ef"}]],os=G("anchor",rs);const ds=[["path",{d:"m21 16-4 4-4-4",key:"f6ql7i"}],["path",{d:"M17 20V4",key:"1ejh1v"}],["path",{d:"m3 8 4-4 4 4",key:"11wl7u"}],["path",{d:"M7 4v16",key:"1glfcx"}]],cs=G("arrow-up-down",ds);const ms=[["path",{d:"M9 10h.01",key:"qbtxuw"}],["path",{d:"M15 10h.01",key:"1qmjsl"}],["path",{d:"M12 2a8 8 0 0 0-8 8v12l3-3 2.5 2.5L12 19l2.5 2.5L17 19l3 3V10a8 8 0 0 0-8-8z",key:"uwwb07"}]],hs=G("ghost",ms);const us=[["path",{d:"m16 6-8.414 8.586a2 2 0 0 0 2.829 2.829l8.414-8.586a4 4 0 1 0-5.657-5.657l-8.379 8.551a6 6 0 1 0 8.485 8.485l8.379-8.551",key:"1miecu"}]],Ne=G("paperclip",us),ve=[{id:"header-analysis",label:"Headers",title:"Headers & authentication",types:["headers","header","authentication","identity"]},{id:"content-analysis",label:"Content",title:"Message content",types:["body","content"]},{id:"domain-analysis",label:"Domain",title:"Sender domain",types:["domain"]},{id:"link-analysis",label:"Links",title:"Links & destinations",types:["links","link"]},{id:"attachment-analysis",label:"Attachments",title:"Attachments",types:["attachments","attachment"]}];function M(r){return String(r?.result||"").trim().toLowerCase()}function P(r){return r?.informational===!0||["info","informational"].includes(String(r?.severity||"").toLowerCase())||/\(informational\b/i.test(String(r?.description||""))}function ps(r){return ve.find(o=>o.types.includes(String(r?.category||r?.type||"").toLowerCase()))?.id||null}function we(r){const o=Array.isArray(r?.checks_results)?r.checks_results:[],c=o.filter(u=>M(u)==="fail"),p=c.filter(P);return{checks:o,failed:c,informational:p,review:c.filter(u=>!P(u)),scoredFailures:L(r?.number_failed_checks,L(r?.Checks_failed)),totalChecks:L(r?.total_checks,L(r?.Checks_total,o.length||null)),urlCount:L(r?.details?.links?.url_count),attachmentCount:L(r?.details?.attachments?.attachment_count)}}function xs(r,o,c){const p=M(r);return o==="review"&&(p!=="fail"||P(r))||o==="pass"&&p!=="pass"||o==="info"&&!P(r)?!1:[r.name,r.category,r.description].filter(Boolean).join(" ").toLowerCase().includes(c.trim().toLowerCase())}function ke(r){const o=String(r||"").trim().toLowerCase();return o==="pass"?{label:"Pass",tone:"pass"}:o==="fail"?{label:"Fail",tone:"fail"}:o==="none"?{label:"None reported",tone:"unknown"}:{label:r||"Not available",tone:"unknown"}}function gs(r,o={}){const c=String(r||"").trim().toLowerCase(),p=o.auth_results||{},u=s=>s==null||s===""?"Not reported":String(s),g=(s,x)=>{const N=ke(x);return{label:s,value:N.label,tone:N.tone}};if(c==="not flagged by upstream spam filter"){const s=u(o.upstream_scl);return{title:"Receiving-filter evidence",rows:[{label:"Spam confidence level (SCL)",value:s},...s!=="Not reported"?[{label:"Source header",value:"X-MS-Exchange-Organization-SCL"}]:[]],note:s==="Not reported"?"The spam confidence level was not included in this report. The check result is preserved, but its underlying filter evidence is unavailable.":"A level of 5 or higher indicates the receiving filter classified the message as spam."}}if(c==="composite authentication valid")return{title:"Composite authentication evidence",rows:[g("Composite authentication (compauth)",p.compauth),{label:"Reason code",value:u(p.compauth_reason)}]};if(c==="envelope sender domain aligned"){const s=!p.smtp_mailfrom&&String(p.dkim).toUpperCase()==="NONE"&&o.return_path;return{title:"Sender alignment evidence",rows:[{label:s?"Envelope sender (Return-Path)":"Envelope sender (smtp.mailfrom)",value:u(s?o.return_path:p.smtp_mailfrom)},{label:"From domain",value:u(p.header_from||o.sender_domain)},g("DKIM authentication",p.dkim),{label:"Alignment finding",value:o.mailfrom_misaligned===!0?"Misalignment detected":o.mailfrom_misaligned===!1?"No misalignment flagged":"Not reported"}]}}return null}function te({checkName:r,headers:o}){const c=gs(r,o);return c?e.jsxs("div",{className:"email-finding-evidence",children:[e.jsx("p",{className:"email-finding-evidence-label",children:c.title}),e.jsx("dl",{className:"email-identity-evidence",children:c.rows.map(({label:p,value:u,tone:g})=>e.jsxs("div",{children:[e.jsx("dt",{children:p}),e.jsx("dd",{"data-tone":g,children:u})]},p))}),c.note&&e.jsx("p",{className:"email-finding-evidence-note",children:c.note})]}):null}te.propTypes={checkName:b.string.isRequired,headers:b.object.isRequired};
1const fs={suspicious:{label:"Suspicious",Icon:H,guidance:"Verify the sender through a trusted channel before replying, opening links, or sharing information."},malicious:{label:"Malicious",Icon:be,guidance:"Avoid interacting with this message. Follow your organizationâs process for reporting and handling malicious email."},clean:{label:"Clean",Icon:Ve,guidance:"No threat was identified by this analysis. Review unexpected requests and any supporting findings in context."}},js={"from matches reply-to":"Replies go to a different address","composite authentication valid":"Composite authentication failed","sender uses email authentication":"Sender authentication is missing","envelope sender domain aligned":"Envelope sender does not align","not flagged by upstream spam filter":"The receiving filter flagged this message"};function _e({check:r,headers:o}){const c=String(r.name||"").trim().toLowerCase(),p=c.match(/^(spf|dkim|dmarc)\b/)?.[1],u=c==="sender uses email authentication"?["spf","dkim","dmarc"]:p?[p]:[];return u.length>0?e.jsxs("div",{className:"email-finding-evidence",children:[e.jsx("p",{className:"email-finding-evidence-label",children:"Authentication reported in headers"}),e.jsx("dl",{className:"email-auth-list",children:u.map(g=>{const s=ke(o.auth_results?.[g]);return e.jsxs("div",{children:[e.jsx("dt",{children:g.toUpperCase()}),e.jsx("dd",{"data-tone":s.tone,children:s.label})]},g)})}),e.jsx("p",{className:"email-finding-evidence-note",children:"A checklist pass can mean no explicit failure was reported; it does not imply authentication passed."})]}):c==="from matches reply-to"||c==="sender identity"?e.jsxs("div",{className:"email-finding-evidence",children:[e.jsx("p",{className:"email-finding-evidence-label",children:"Addresses reported in headers"}),e.jsxs("dl",{className:"email-identity-evidence",children:[e.jsxs("div",{children:[e.jsx("dt",{children:"From"}),e.jsx("dd",{children:o.from||"Not available"})]}),e.jsxs("div",{children:[e.jsx("dt",{children:"Reply-To"}),e.jsx("dd",{children:o.reply_to||"Not provided"})]})]})]}):e.jsx(te,{checkName:r.name||"",headers:o})}_e.propTypes={check:b.object.isRequired,headers:b.object.isRequired};function Se({report:r,onInspect:o}){const c=we(r),p=String(r.determination||"").toLowerCase(),u=fs[p]||{label:"Verdict unavailable",Icon:Ze,guidance:"Review the available evidence. A missing verdict does not establish that this message is safe."},{Icon:g}=u,s=r.details?.headers||{};return e.jsxs(e.Fragment,{children:[e.jsxs("section",{className:"email-verdict","data-verdict":p,"aria-labelledby":"email-verdict-heading",children:[e.jsxs("div",{className:"email-verdict-main",children:[e.jsxs("div",{className:"email-verdict-label",children:[e.jsx("span",{className:"email-verdict-icon",children:e.jsx(g,{size:27})}),e.jsxs("div",{children:[e.jsx("p",{children:"Analysis verdict"}),e.jsx("h2",{id:"email-verdict-heading",children:u.label})]})]}),e.jsxs("dl",{className:"email-verdict-stats",children:[e.jsxs("div",{children:[e.jsx("dt",{children:"Scored failures"}),e.jsx("dd",{children:c.scoredFailures??"â"})]}),e.jsxs("div",{children:[e.jsx("dt",{children:"Checks evaluated"}),e.jsx("dd",{children:c.totalChecks??"â"})]})]})]}),e.jsxs("div",{className:"email-next-step",children:[e.jsx("span",{children:"Suggested next step"}),e.jsx("p",{children:u.guidance})]})]}),e.jsxs("div",{className:"email-message-details",children:[e.jsxs("dl",{className:"email-message-context",children:[e.jsxs("div",{children:[e.jsx("dt",{children:"From"}),e.jsx("dd",{children:s.from||"Not available"})]}),e.jsxs("div",{children:[e.jsx("dt",{children:"Reply-To"}),e.jsx("dd",{children:s.reply_to||"Not provided"})]})]}),e.jsxs("div",{className:"email-artifact-counts",role:"group","aria-label":"Message contents",children:[e.jsxs("button",{type:"button",onClick:()=>o("link-analysis"),children:[e.jsx(se,{size:15}),e.jsxs("span",{children:[e.jsx("strong",{children:c.urlCount??"â"})," URLs found"]}),e.jsx(Z,{size:13})]}),e.jsxs("button",{type:"button",onClick:()=>o("attachment-analysis"),children:[e.jsx(Ne,{size:15}),e.jsxs("span",{children:[e.jsx("strong",{children:c.attachmentCount??"â"})," attachments"]}),e.jsx(Z,{size:13})]})]})]}),e.jsxs("section",{id:"email-findings",className:"email-findings-panel","aria-labelledby":"email-findings-heading",children:[e.jsxs("div",{className:"email-section-heading",children:[e.jsx("h2",{id:"email-findings-heading",children:"Needs review"}),e.jsxs("span",{children:[c.review.length," ",c.review.length===1?"check":"checks"]})]}),e.jsx("p",{className:"email-section-intro",children:"Flagged checks from this analysis, with their supporting evidence."}),e.jsxs("div",{className:"email-finding-list",children:[c.review.map((x,N)=>{const w=ps(x);return e.jsxs("details",{className:"email-finding",children:[e.jsxs("summary",{children:[e.jsx("span",{className:"finding-index",children:String(N+1).padStart(2,"0")}),e.jsxs("span",{children:[e.jsx("strong",{children:js[String(x.name||"").toLowerCase()]||x.name}),e.jsx("small",{children:x.category||"Security check"})]}),e.jsx("span",{className:"finding-expand",children:"+"})]}),e.jsxs("div",{children:[e.jsx("p",{children:x.description||"The analyzer returned a failed result for this check."}),e.jsx(_e,{check:x,headers:s}),e.jsxs("p",{className:"finding-original-name",children:[e.jsxs("span",{children:["Original check: ",x.name]}),e.jsxs("span",{className:"finding-result",children:["Result:",e.jsxs("span",{className:"email-check-status","data-tone":M(x),children:[M(x)==="fail"&&e.jsx(be,{size:12}),x.result||"Unknown"]})]})]}),w&&e.jsxs("button",{type:"button",onClick:()=>o(w),children:["Inspect evidence ",e.jsx(Z,{size:14})]})]})]},`${x.name}-${N}`)}),c.review.length===0&&e.jsxs("div",{className:"email-no-findings",children:[e.jsx(ee,{size:18}),e.jsx("p",{children:c.checks.length?"No non-informational checks returned a failed result. Review the verdict and evidence for the complete picture.":"The detailed checklist is unavailable for this report."})]})]}),c.informational.length>0&&e.jsxs("details",{className:"email-context-findings",children:[e.jsxs("summary",{children:[e.jsx(J,{size:14}),c.informational.length," informational"," ",c.informational.length===1?"result":"results"]}),e.jsx("div",{children:c.informational.map((x,N)=>e.jsxs("div",{children:[e.jsx("strong",{children:x.name}),e.jsx("p",{children:x.description}),e.jsxs("small",{children:["Reported result: ",x.result," · Informational"]})]},N))})]}),e.jsxs("p",{className:"email-scoring-note",children:["The verdict and scored totals come from the analyzer. The complete checklist includes informational results.",c.failed.length!==c.scoredFailures&&c.scoredFailures!==null?` It contains ${c.failed.length} failed results; the server reports ${c.scoredFailures} scored failures.`:""]})]})]})}Se.propTypes={report:b.object.isRequired,onInspect:b.func.isRequired};function Ce({isOpen:r,onClose:o,title:c,content:p}){const u=j.useRef(null);return j.useEffect(()=>{if(!r)return;const g=document.activeElement;return u.current?.querySelector("button")?.focus(),()=>g?.focus?.({preventScroll:!0})},[r]),j.useEffect(()=>{const g=s=>{u.current&&!u.current.contains(s.target)&&o()};return r&&document.addEventListener("mousedown",g),()=>{document.removeEventListener("mousedown",g)}},[r,o]),j.useEffect(()=>{const g=s=>{if(s.key==="Escape"&&o(),s.key==="Tab"){const x=u.current?.querySelectorAll('button, a[href], input, select, textarea, [tabindex="0"]');if(!x?.length)return;const N=x[0],w=x[x.length-1];
1s.shiftKey&&document.activeElement===N?(s.preventDefault(),w.focus()):!s.shiftKey&&document.activeElement===w&&(s.preventDefault(),N.focus())}};return r&&document.addEventListener("keydown",g),()=>{document.removeEventListener("keydown",g)}},[r,o]),r?e.jsx("div",{className:"fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/60 backdrop-blur-sm animate-in fade-in duration-200",children:e.jsxs("div",{ref:u,role:"dialog","aria-modal":"true","aria-label":c,className:"w-full max-w-2xl bg-slate-900 border border-slate-700 rounded-2xl shadow-2xl overflow-hidden animate-in zoom-in-95 duration-200",children:[e.jsxs("div",{className:"p-6 border-b border-slate-700 flex justify-between items-center bg-slate-800/50",children:[e.jsxs("h3",{className:"text-xl font-bold text-white flex items-center gap-2",children:[e.jsx(J,{className:"w-5 h-5 text-purple-400"})," ",c]}),e.jsx("button",{onClick:o,"aria-label":"Close report explanation",className:"text-slate-400 hover:text-white transition-colors text-2xl leading-none",children:"Ã"})]}),e.jsx("div",{className:"p-6 max-h-[70vh] overflow-y-auto",children:e.jsx("div",{className:"prose prose-invert max-w-none",children:p})}),e.jsx("div",{className:"p-4 border-t border-slate-700 bg-slate-800/50 flex justify-end",children:e.jsx("button",{onClick:o,className:"px-4 py-2 bg-slate-700 text-white rounded-lg hover:bg-slate-600 transition-colors font-medium",children:"Got it"})})]})}):null}Ce.propTypes={isOpen:b.bool.isRequired,onClose:b.func.isRequired,title:b.string,content:b.node};const ys="inline-flex w-fit items-center gap-2 rounded-md border border-slate-700/60 bg-slate-800/50 px-4 py-2 text-sm font-medium text-slate-300 transition-colors hover:border-slate-600 hover:bg-slate-800 hover:text-white",ye={authentication:"header-analysis",identity:"header-analysis",headers:"header-analysis",header:"header-analysis",content:"content-analysis",body:"content-analysis",domain:"domain-analysis",links:"link-analysis",link:"link-analysis",attachments:"attachment-analysis",attachment:"attachment-analysis"};function ae(r,o,c="Report",p=""){if(o!=null){if(Array.isArray(o)){if(o.every(u=>u===null||typeof u!="object")){r.push([c,p||"Values",o.join("; ")]);return}o.forEach((u,g)=>{ae(r,u,c,`${p||"Item"} ${g+1}`)});return}if(typeof o=="object"){Object.entries(o).forEach(([u,g])=>{const s=p?`${p}.${u}`:u;ae(r,g,c,s)});return}r.push([c,p||"Value",o])}}function bs(r){return r.map(o=>o.map(c=>`"${String(c??"").replace(/"/g,'""')}"`).join(",")).join(` 2`)}function Rs(){const{jobId:r}=Ke(),o=es(),{getValidToken:c}=Be(),{refreshCreditBalance:p}=He(),{registerJob:u,registerJobByType:g}=Je(),[s,x]=j.useState(null),[N,w]=j.useState(!0),[ie,W]=j.useState(null),[ne,X]=j.useState(null),[C,le]=j.useState({isOpen:!1,section:null}),[v,Ae]=j.useState({key:"result",direction:"ascending"}),[I,Le]=j.useState(""),[Ie,_]=j.useState({}),[Ee,Te]=j.useState(!1),[re,oe]=j.useState("all"),[de,ce]=j.useState(""),E=a=>{const l=document.getElementById(a);l&&(l.tagName==="DETAILS"&&(l.open=!0),requestAnimationFrame(()=>{l.scrollIntoView({behavior:window.matchMedia("(prefers-reduced-motion: reduce)").matches?"instant":"smooth",block:"start"}),l.querySelector("summary")?.focus({preventScroll:!0})}
2))};j.useEffect(()=>{let a=!1;const l=c();if(l)return fetch(`https://api.bluelanternsecurity.io/runs/${r}`,{method:"GET",headers:{Authorization:`${l}`,"Content-Type":"application/json"}}).then(i=>i.ok?i.json():null).then(i=>{if(a||!i)return;let t=i;if(i?.body&&typeof i.body=="string")try{t=JSON.parse(i.body)}catch{t=i}let d=t?.result??t;Array.isArray(d)&&(d=d[0]),String(d?.run_status||d?.RUN_STATUS||"").toUpperCase()==="FILTERED"&&Te(!0)}).catch(()=>{}),()=>{a=!0}},[r,c]),j.useEffect(()=>{(async()=>{try{const l=c();if(!l)return;const{id:i}=await ss(l);Le(i)}catch(l){console.error("Failed to load URL detonator tool info",l)}})()},[c]);const De=async a=>{if(!a)return;const l=String(a);let i;try{i=as(a)}catch(d){_(m=>({...m,[l]:{status:"error",error:d.message}}));return}const t=c();if(!t){_(d=>({...d,[l]:{status:"error",error:"Authentication required"}}));return}if(!I){_(d=>({...d,[l]:{status:"error",error:"URL Threat Analyzer unavailable"}}));return}_(d=>({...d,[l]:{status:"submitting"}}));try{const d=await fetch("https://api.bluelanternsecurity.io/runs",{method:"POST",headers:{Authorization:`${t}`,"Content-Type":"application/json"},body:JSON.stringify({tool:I,checkCost:!1,url:i})}),m=await d.json();let h=m;if(m.body&&typeof m.body=="string")try{h=JSON.parse(m.body)}catch{}const f=h.jobId||h.job_id||h.id||h.JobId||h.result&&h.result.id,k=h.message&&h.message.includes("Job Created");if(!d.ok||!f&&!k){const F=h.error||h.message||"Submission failed";_(Y=>({...Y,[l]:{status:"error",error:F}}));return}f?u(f,"URLDETONATIONENGINE",i):g("URLDETONATIONENGINE",i),_(F=>({...F,[l]:{status:"submitted"}})),p()}catch(d){console.error("URL detonation submission failed",d),_(m=>({...m,[l]:{status:"error",error:d.message||"Submission failed"}}))}},me={headers:{title:"Understanding Header Analysis",content:e.jsxs("div",{className:"space-y-4 text-slate-300",children:[e.jsx("p",{children:"Header analysis examines the technical routing information of an email to verify its origin and authenticity."}),e.jsxs("h4",{className:"text-white font-semibold flex items-center gap-2",children:[e.jsx(je,{className:"w-4 h-4"})," Authentication Standards"]}),e.jsxs("ul",{className:"list-disc pl-5 space-y-2",children:[e.jsxs("li",{children:[e.jsx("strong",{className:"text-white",children:"SPF (Sender Policy Framework)"}),": Verifies if the sending server is authorized to send email for that domain."]}),e.jsxs("li",{children:[e.jsx("strong",{className:"text-white",children:"DKIM (DomainKeys Identified Mail)"}),": Adds a cryptographic signature to ensure the email content wasn't tampered with."]}),e.jsxs("li",{children:[e.jsx("strong",{className:"text-white",children:"DMARC"}),": A policy that tells receiving servers what to do if SPF or DKIM fails (e.g., Reject, Quarantine)."]})]}),e.jsxs("h4",{className:"text-white font-semibold mt-4 flex items-center gap-2",children:[e.jsx(ls,{className:"w-4 h-4"})," Sender Mismatch"]}),e.jsxs("p",{children:["Attackers often spoof the ",e.jsx("strong",{children:"From"}),' address to look like a legitimate sender (e.g., "CEO"), but the email actually comes from a different ',e.jsx("strong",{children:"Return-Path"})," or"," ",e.jsx("strong",{children:"Reply-To"})," address. A mismatch here is a strong indicator of phishing."]})]})},content:{title:"Analyzing Email Content",content:e.jsxs("div",{className:"space-y-4 text-slate-300",children:[e.jsx("p",{children:"Content analysis scans the email body and subject line for psychological triggers and malicious patterns."}),e.jsxs("h4",{className:"text-white font-semibold flex items-center gap-2",children:[e.jsx(H,{className:"w-4 h-4"})," Social Engineering Triggers"]}),e.jsxs("ul",{className:"list-disc pl-5 space-y-2",children:[e.jsxs("li",{children:[e.jsx("strong",{className:"text-amber-300",children:"Urgency"}),': Phrases like "Immediate Action Required", "Account Suspended", or "Final Notice" designed to panic users into acting without thinking.']}),e.jsxs("li",{children:[e.jsx("strong",{className:"text-amber-300",children:"Financial Lures"}),': Promises of "Direct Deposit", "Lottery Win", or "Invoice Due".']})]}),e.jsxs("h4",{className:"text-white font-semibold mt-4 flex items-center gap-2",children:[e.jsx(Ye,{className:"w-4 h-4"})," Obfuscation Techniques"]}),e.jsx("p",{children:"Attackers try to hide keywords from spam filters by using:"}),e.jsxs("ul",{className:"list-disc pl-5",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Homoglyphs"}),': Using Cyrillic or other unicode characters that look like English letters (e.g., "a" vs "а").']}),e.jsxs("li",{children:[e.jsx("strong",{children:"Zero-width spaces"}),": Inserting invisible characters between letters to break keyword matching."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Hidden Content"}),": Using CSS like"," ",e.jsx("code",{children:"display:none"}),` to hide random text ("word salad") that confuses spam filters but isn't visible to you.`]})]})]})},domain:{title:"Domain Risk Assessment",content:e.jsxs("div",{className:"space-y-4 text-slate-300",children:[e.jsx("p",{children:"Domain analysis investigates the reputation and age of the sender's domain."}),e.jsxs("h4",{className:"text-white font-semibold flex items-center gap-2",children:[e.jsx(ns,{className:"w-4 h-4"})," Newly Registered Domains"]}),e.jsx("p",{children:'Legitimate businesses usually have established domains. Phishing c
2ampaigns often use "burner" domains registered just days or hours ago. A domain less than 3 months old is highly suspicious.'}),e.jsxs("h4",{className:"text-white font-semibold mt-4 flex items-center gap-2",children:[e.jsx(hs,{className:"w-4 h-4"})," Spoofing & Lookalikes"]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Typosquatting"})," involves registering domains that look similar to trusted brands (e.g., `googIe.com` with a capital 'i' instead of `google.com`)."]}),e.jsxs("p",{children:[e.jsx("strong",{children:"WHOIS Privacy"}),": While common, complete redaction or missing WHOIS data can indicate a throwaway domain used for malicious purposes."]})]})},links:{title:"Link & URL Analysis",content:e.jsxs("div",{className:"space-y-4 text-slate-300",children:[e.jsx("p",{children:"Links are the most common vector for phishing attacks. We analyze every link to detect malicious intent."}),e.jsxs("h4",{className:"text-white font-semibold flex items-center gap-2",children:[e.jsx(se,{className:"w-4 h-4"})," Suspicious Hosting"]}),e.jsx("p",{children:"Attackers often abuse legitimate cloud services (Google Drive, Dropbox, IPFS) to host phishing pages, hoping the trusted domain (e.g., `googleapis.com`) will bypass filters."}),e.jsxs("h4",{className:"text-white font-semibold mt-4 flex items-center gap-2",children:[e.jsx(os,{className:"w-4 h-4"})," Anchor Text Mismatch"]}),e.jsx("p",{children:'This occurs when the text you see says one thing (e.g., "Login to PayPal") but the actual link goes somewhere else (e.g., `bad-site.com`). This is a classic phishing tactic.'})]})},attachments:{title:"Attachment Safety",content:e.jsxs("div",{className:"space-y-4 text-slate-300",children:[e.jsx("p",{children:"Malicious attachments can install ransomware or spyware on your device."}),e.jsxs("h4",{className:"text-white font-semibold flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," High-Risk File Types"]}),e.jsxs("ul",{className:"list-disc pl-5 space-y-2",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Executables (.exe, .scr)"}),": Can run any code on your computer."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Office Documents (.docm, .xlsm)"}),": Can contain malicious Macros (VBA scripts) that download malware when enabled."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Archives (.zip, .rar)"}),": Often used to hide the actual malicious file type from scanners."]})]})]})}},T=a=>{le({isOpen:!0,section:a})},he=a=>{if(a.checks_results&&Array.isArray(a.checks_results)){const d=a.checks_results.map(m=>{if(m.category)return m;if(m.type){const k=m.type.charAt(0).toUpperCase()+m.type.slice(1);return{...m,category:k}}let h="Other";const f=m.name||"";return["SPF","DKIM","DMARC","Authentication"].some(k=>f.includes(k))?h="Authentication":f.includes("Identity")||f.includes("From")||f.includes("Mismatch")?h="Identity":f.includes("Link")||f.includes("URL")?h="Links":f.includes("Content")||f.includes("Keyword")||f.includes("Grammar")?h="Content":f.includes("Domain")&&(h="Domain"),{...m,category:h}});return{...a,checks_results:d,details:{headers:a.details?.headers||a.headers||{},body:a.details?.body||a.body||{},domain:a.details?.domain||a.domain||{},links:a.details?.links||a.links||{},attachments:a.details?.attachments||a.attachments||{}}}}const l=a.headers||{},i=[{category:"Authentication",name:"SPF Record",result:l.auth_results?.spf?.toUpperCase()==="PASS"?"Pass":"Fail",description:"Sender Policy Framework"},{category:"Authentication",name:"DKIM Signature",result:l.auth_results?.dkim?.toUpperCase()==="PASS"?"Pass":"Fail",description:"DomainKeys Identified Mail"},{category:"Authentication",name:"DMARC Policy",result:l.auth_results?.dmarc?.toUpperCase()==="PASS"?"Pass":"Fail",description:"Domain-based Message Authentication"},{category:"Identity",name:"Sender Identity",result:l.mismatch_detected?"Fail":"Pass",description:"From vs Reply-To consistency"},{category:"Links",name:"Link Safety",result:a.links?.findings?.length===0&&a.links?.lookalikes?.length===0?"Pass":"Fail",description:"URL analysis for malicious links"},{category:"Content",name:"Content Safety",result:a.body?.keyword_count===0&&a.body?.urgency_patterns?.length===0?"Pass":"Fail",description:"Phishing keyword analysis"},{category:"Domain",name:"Domain Reputation",result:a.domain?.findings?.length===0?"Pass":"Fail",description:"Domain age and reputation"}],t=i.filter(d=>d.result==="Fail").length;return{...a,filename:a.filename,analyzed_at:a.analyzed_at,status:a.status,Checks_failed:t,Checks_total:i.length,checks_results:i,details:a.details||{headers:a.headers||{},body:a.body||{},domain:a.domain||{},links:a.links||{},attachments:a.attachments||{}}}},Fe=j.useMemo(()=>
2{if(!s?.checks_results)return[];let a=[...s.checks_results];return v.key&&a.sort((l,i)=>{let t=l[v.key],d=i[v.key];return v.key,t<d?v.direction==="ascending"?-1:1:t>d?v.direction==="ascending"?1:-1:0}),a},[s,v]),Re=a=>{let l="ascending";v.key===a&&v.direction==="ascending"&&(l="descending"),Ae({key:a,direction:l})},D=({label:a,sortKey:l,className:i=""})=>e.jsx("th",{className:`px-6 py-4 font-semibold text-xs uppercase tracking-wider cursor-pointer hover:bg-slate-800/50 transition-colors select-none ${i}`,"aria-sort":v.key===l?v.direction:"none",children:e.jsxs("button",{type:"button",onClick:()=>Re(l),className:`flex items-center gap-2 ${i.includes("center")?"justify-center":""}`,children:[a,e.jsx(cs,{className:`w-3 h-3 ${v.key===l?"text-cyan-300":"text-slate-600"}`})]})});D.propTypes={label:b.node.isRequired,sortKey:b.string.isRequired,className:b.string},j.useEffect(()=>{const a=async()=>{const l=c();if(!l){W("Authentication required"),w(!1);return}try{const i=await fetch("https://api.bluelanternsecurity.io/results",{method:"POST",headers:{Authorization:`${l}`,"Content-Type":"application/json"},body:JSON.stringify({jobId:r})}),t=await i.text();let d;try{d=JSON.parse(t)}catch{throw X({rawText:t,status:i.status}),new Error("Failed to parse JSON response")}if(!i.ok)throw X(d),new Error(`HTTP error! status: ${i.status}`);let m=d;if(d.body&&typeof d.body=="string")try{m=JSON.parse(d.body)}catch{}if(X(m),m.result){const h=he(m.result);x(h),w(!1)}else m.status==="Running"||m.status==="Queued"?setTimeout(a,2e3):m.filename&&m.headers?(x(he(m)),w(!1)):(W(m.error||"Report data unavailable"),w(!1))}catch(i){console.error("Error fetching report:",i),W(i.message||"Failed to load report"),w(!1)}};a()},[r,c]);const Ue=()=>{if(!s)return;const a=[["Section","Field","Value"]];ae(a,s,"Email Analysis");const l=bs(a),i=new Blob([l],{type:"text/csv"}),t=window.URL.createObjectURL(i),d=document.createElement("a");d.href=t,d.download=`email_report_${r}.csv`,document.body.appendChild(d),d.click(),document.body.removeChild(d),window.URL.revokeObjectURL(t)};if(N)return e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex items-center justify-center",children:e.jsxs("div",{className:"text-center",children:[e.jsx("div",{className:"w-16 h-16 mx-auto mb-4 border-4 border-cyan-500/30 border-t-cyan-400 rounded-full animate-spin"}),e.jsx("p",{className:"text-lg text-slate-300",children:"Loading analysisâ¦"})]})});if(ie||!s)return e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex flex-col items-center justify-center p-8",children:e.jsxs("div",{className:"text-center max-w-2xl w-full",children:[e.jsx(y,{className:"w-16 h-16 text-yellow-400 mx-auto mb-4"}),e.jsx("h1",{className:"text-2xl font-bold mb-2",children:ie||"Report Not Found"}),e.jsxs($,{to:o.to,className:`${ys} mb-8`,children:["â ",o.label]}),ne&&e.jsxs("div",{className:"bg-slate-900 border border-slate-800 rounded-xl p-4 text-left overflow-hidden",children:[e.jsx("p",{className:"text-xs text-slate-500 uppercase tracking-wider mb-2 font-bold",children:"Debug Info"}),e.jsx("pre",{className:"text-xs font-mono text-slate-300 overflow-x-auto whitespace-pre-wrap break-all",children:JSON.stringify(ne,null,2)})]})]})});const ue=a=>{const l=M(a),i=P(a),t=i?"info":l==="fail"?"fail":l==="pass"?"pass":"unknown";return e.jsxs("span",{className:"email-check-status","data-tone":t,children:[i&&e.jsx(J,{size:12}),a.result||"Unknown",i?" · Info":""]})},$e=a=>{const l=a?.toUpperCase();return l==="PASS"?{className:"email-tone-success",label:e.jsxs("span",{className:"inline-flex items-center gap-1",children:[e.jsx(ee,{className:"w-4 h-4"})," Pass"]})}:l==="FAIL"?{className:"email-tone-danger",label:e.jsxs("span",{className:"inline-flex items-center gap-1",children:[e.jsx(Qe,{className:"w-4 h-4"})," Fail"]})}:l==="UNKNOWN"?{className:"email-tone-muted",label:"Unknown"}:{className:"email-tone-muted",label:l==="NONE"?"None reported":a||"Not available"}},Q=s.details.headers.auth_results||{},ze=[{label:"SPF",value:Q.spf},{label:"DKIM",value:Q.dkim},{label:"DMARC",value:Q.dmarc}],S=we(s),O=Fe.filter(a=>xs(a,re,de)),Me=s.analyzed_at&&Number.isFinite(Date.parse(s.analyzed_at))?new Date(s.analyzed_at).toLocaleStr
2ing():"Time unavailable";return e.jsxs("div",{className:"email-analysis-page min-h-screen bg-slate-950 text-white",children:[e.jsxs("div",{className:"relative max-w-6xl mx-auto px-4 pb-12 pt-24 sm:px-6 sm:pb-16 sm:pt-28",children:[e.jsxs("header",{className:"email-report-header",children:[e.jsxs($,{to:o.to,className:"email-report-back",children:["â ",o.label]}),e.jsxs("div",{className:"email-report-title-row",children:[e.jsxs("div",{children:[e.jsx("p",{className:"email-report-eyebrow",children:"Threat analysis / Email"}),e.jsx("h1",{children:"Email Analysis Report"})]}),e.jsxs("div",{className:"email-report-actions",children:[e.jsxs("button",{type:"button",onClick:Ue,children:[e.jsx(ts,{size:15}),"Download CSV"]}),e.jsx($,{to:"/email-analyzer",children:"Analyze another email"})]})]}),e.jsxs("div",{className:"email-file-meta",children:[e.jsxs("span",{children:[e.jsx(ge,{size:15}),s.filename||"Email file"]}),e.jsxs("span",{children:["Analyzed ",Me]})]})]}),Ee&&e.jsxs("div",{className:"mb-8 flex items-start gap-3 rounded-[14px] border border-cyan-500/30 bg-cyan-500/10 p-5",children:[e.jsx(is,{className:"mt-0.5 h-5 w-5 shrink-0 text-cyan-200"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-cyan-200",children:"This email was automatically quarantined"}),e.jsxs("p",{className:"mt-1 text-slate-300",children:["After analysis, this message matched your account's spam rules, so your mail integration moved it out of the recipient's inbox â to"," ",e.jsx("span",{className:"text-white",children:"Spam"})," in Gmail, or"," ",e.jsx("span",{className:"text-white",children:"Junk Email"})," in Outlook. No one had to click anything; the full analysis that triggered the move is below. The message was not deleted and can be restored from that folder if this was a false positive."]})]})]}),e.jsx("nav",{className:"email-report-jump-nav","aria-label":"Email report sections",children:[{id:"email-findings",label:"Findings"},...ve,{id:"security-checks",label:"All checks"}].map(a=>e.jsx("a",{href:`#${a.id}`,onClick:l=>{l.preventDefault(),E(a.id)},children:a.label},a.id))}),e.jsx(Se,{report:s,onInspect:E}),e.jsxs("div",{className:"email-evidence-title",children:[e.jsx("h2",{children:"Explore the evidence"}),e.jsx("p",{children:"Open a section for the complete technical analysis."})]}),(()=>{const a=s.details.headers.auth_results||{},l=s.details.headers.mismatch_detected||["spf","dkim","dmarc"].some(t=>a[t]?.toLowerCase()==="fail"),i=["spf","dkim","dmarc"].some(t=>!a[t]||a[t]?.toLowerCase()==="none");return e.jsxs(z,{id:"header-analysis",title:"Headers & authentication",description:"Sender identity, SPF, DKIM, DMARC, and routing",Icon:ge,tone:l?"danger":i?"warning":"neutral",onInfo:()=>T("headers"),children:[e.jsxs("div",{className:"email-data-grid mb-6",children:[e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"From address"}),e.jsx("p",{className:"email-data-value",children:s.details.headers.from})]}),s.details.headers.reply_to&&e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Reply-To"}),e.jsx("p",{className:"email-data-value",children:s.details.headers.reply_to})]})]}),s.details.headers.mismatch_detected&&e.jsxs("div",{className:"email-data-notice email-data-notice-danger mb-6",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-danger flex items-center gap-2",children:[e.jsx(y,{className:"w-5 h-5"})," Sender mismatch detected"]}),e.jsx("p",{className:"email-data-copy mt-2",children:"The Reply-To address differs from the From address, which may indicate spoofing."})]}),e.jsxs("div",{className:"mb-6",children:[e.jsx("p",{className:"email-data-subheading",children:"Email authentication results"}),e.jsx("div",{className:"email-data-grid email-data-grid-three",children:ze.map(t=>{const d=$e(t.value);return e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:t.label}),e.jsx("p",{className:`email-data-value ${d.className}`,children:d.label})]},t.label)})})]}),e.jsx("div",{className:"email-header-check-evidence",children:["Composite Authentication Valid","Envelope Sender Domain Aligned","Not Flagged By Upstream Spam Filter"].map(t=>e.jsx(te,{checkName:t,headers:s.details.headers},t))}),s.details.headers.email_path&&s.details.headers.email_path.length>0&&e.jsxs("div",{children:[e.jsx("p",{className:"email-data-subheading",children:"Email routing path"}),e.jsx("div",{className:"email-data-card email-route-card",children:e.jsx("div",{className:"email-route-list",children:s.details.headers.email_path.map((t,d)=>{const m=d===s.details.headers.email_path.length-1,h=t.latency_seconds,f=h>600,k=h<-5;return e.jsxs("div",{className:"email-route-hop",children:[!m&&e.jsx("div",{className:`email-route-line ${f?"email-route-line-delayed":""}`}),e.jsx("div",{className:"email-route-node","data-endpoint":d===0||m,children:d+1}),e.jsx("div",{className:"email-route-content",children:e.jsxs("div",{className:"flex flex-col sm:flex-row sm:items-start justify-between gap-2",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsxs("p",{className:"email-route-server",children:[e.jsx("span",{className:"min-w-0 break-all",children:m?"Delivered to recipient":t.server}),t.country&&e.jsx("span",{className:"email-data-tag",children:t.country})]}),m&&e.jsxs("p",{className:"email-data-caption mt-1 break-all",children:["via ",t.server]}),e.jsx("p",{className:"email-data-caption mt-1",children:t.time?new Date(t.time).toLocaleStr
2ing():"Timestamp unavailable"})]}),d>0&&h!==void 0&&e.jsxs("div",{className:`email-data-tag self-start ${f?"email-data-tag-danger":k?"email-data-tag-warning":""}`,children:[e.jsxs("span",{children:[h>0?"+":"",h<60?`${h.toFixed(1)}s`:h<3600?`${(h/60).toFixed(1)}m`:`${(h/3600).toFixed(1)}h`]}),f&&e.jsxs("span",{className:"inline-flex items-center gap-1",children:[e.jsx(y,{className:"w-3 h-3"})," ","Delay"]}),k&&e.jsxs("span",{className:"inline-flex items-center gap-1",children:[e.jsx(y,{className:"w-3 h-3"})," ","Time skew"]})]})]})})]},d)})})})]})]})})(),(()=>{const a=s.details.body.findings?.length>0||s.details.body.keyword_count>5||s.details.body.has_scripts,l=s.details.body.keyword_count>0||s.details.body.urgency_patterns?.length>0||s.details.body.character_substitutions?.length>0;return e.jsxs(z,{id:"content-analysis",title:"Message content",description:"Language patterns, hidden content, and active scripts",Icon:Ge,tone:a?"danger":l?"warning":"neutral",onInfo:()=>T("content"),children:[e.jsxs("div",{className:"email-data-grid email-data-grid-three mb-6",children:[e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Phishing keywords"}),e.jsx("p",{className:"email-data-stat",children:s.details.body.keyword_count??"â"})]}),e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Grammar issues"}),e.jsx("p",{className:"email-data-stat",children:s.details.body.grammar_issues??"â"})]}),e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Active scripts"}),e.jsx("p",{className:`email-data-value ${s.details.body.has_scripts===!0?"email-tone-danger":s.details.body.has_scripts===!1?"email-tone-success":"text-slate-400"}`,children:s.details.body.has_scripts===!0?"Yes":s.details.body.has_scripts===!1?"No":"Not reported"})]})]}),s.details.body.keywords_found&&s.details.body.keywords_found.length>0&&e.jsxs("div",{className:"mb-6",children:[e.jsx("p",{className:"email-data-subheading",children:"Suspicious keywords detected"}),e.jsx("div",{className:"flex flex-wrap gap-2",children:s.details.body.keywords_found.map((i,t)=>e.jsx("span",{className:"email-data-tag email-data-tag-danger",children:i},t))})]}),s.details.body.urgency_patterns&&s.details.body.urgency_patterns.length>0&&e.jsxs("div",{className:"mb-6",children:[e.jsx("p",{className:"email-data-subheading",children:"Urgency tactics detected"}),e.jsx("div",{className:"flex flex-wrap gap-2",children:s.details.body.urgency_patterns.map((i,t)=>e.jsx("span",{className:"email-data-tag email-data-tag-warning",children:i},t))})]}),s.details.body.character_substitutions&&s.details.body.character_substitutions.length>0&&e.jsxs("div",{className:"email-data-notice email-data-notice-warning",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-warning mb-3 flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," Character substitutions found"]}),e.jsx("div",{className:"space-y-2",children:s.details.body.character_substitutions.map((i,t)=>e.jsx("p",{className:"email-data-copy font-mono",children:i},t))})]}),s.details.body.has_scripts&&e.jsxs("div",{className:"email-data-notice email-data-notice-danger mt-4",children:[e.jsxs("p",{className:"email-tone-danger email-data-notice-title flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," Active scripts detected"]}),e.jsx("p",{className:"email-data-copy mt-2",children:"The email body contains executable scripts, which can be used to deliver malware or steal information."})]}),s.details.body.findings&&s.details.body.findings.length>0&&e.jsxs("div",{className:"email-data-notice email-data-notice-danger mt-4",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-danger mb-3 flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," Content warnings"]}),e.jsx("ul",{className:"space-y-2",children:s.details.body.findings.map((i,t)=>e.jsxs("li",{className:"email-data-copy flex items-start gap-2",children:[e.jsx("span",{className:"email-tone-danger mt-0.5",children:"â¢"}),e.jsx("span",{children:i})]},t))})]})]})})(),s.details.domain&&(()=>{const a=s.details.domain.findings?.length>0,l=s.details.domain.domain_info?.age_days!=null&&s.details.domain.domain_info.age_days<90;return e.jsxs(z,{id:"domain-analysis",title:"Sender domain",description:"Registration details and domain risk indicators",Icon:fe,tone:a?"danger":l?"warning":"neutral",onInfo:()=>T("domain"),children:[e.jsxs("div",{className:"email-data-grid mb-6",children:[e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Sender domain"}),e.jsx("p",{className:"email-data-value",children:s.details.domain.domain_info?.domain}),s.details.domain.domain_info?.subdomain&&e.jsxs("p",{className:"email-data-caption mt-2",children:["Subdomain: ",s.details.domain.domain_info.subdomain]}),s.details.domain.domain_info?.root_domain&&s.details.domain.domain_info.root_domain!==s.details.domain.domain_info.domain&&e.jsxs("p",{className:"email-data-caption mt-1",children:["Root: ",s.details.domain.domain_info.root_domain]})]}),s.details.domain.domain_info?.age_days!==null&&s.details.domain.domain_info?.age_days!==void 0&&e.jsxs("div",{className:"email-data-card",children:[e.jsx("p",{className:"email-data-label",children:"Domain age"}),e.jsx("p",{className:`email-data-value ${s.details.domain.domain_info.age_days<90?"email-tone-danger":s.details.domain.domain_info.age_days<365?"email-tone-warning":"email-tone-success"}`,children:s.details.domain.domain_info.age_days<30?`${s.details.domain.domain_info.age_days} days`:s.details.domain.domain_info.age_days<365?`${Math.floor(s.details.domain.domain_info.age_days/30)} months`:`${Math.floor(s.details.domain.domain_info.age_days/365)} years`})]})]}),s.details.domain.domain_info?.creation_date&&e.jsxs("div",{className:"email-data-card mb-6",children:[e.jsx("p",{className:"email-data-label",children:"Domain created"}),e.jsx("p",{className:"email-data-value",children:new Date(s.details.domain.domain_info.creation_date).toLocaleDateString("en-US",{year:"numeric",month:"long",day:"numeric"})}),s.details.domain.domain_info.registrar&&e.jsxs("p",{className:"email-data-caption mt-2",children:["Registrar: ",s.details.domain.domain_info.registrar]})]}),s.details.domain.findings&&s.details.domain.findings.length>0&&e.jsxs("div",{className:"email-data-notice email-data-notice-danger mb-6",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-danger mb-3 flex items-center gap-2",children:[e.jsx(H,{className:"w-5 h-5"})," Domain risk indicators"]}),e.jsx("ul",{className:"space-y-2",children:s.details.domain.findings.map((i,t)=>e.jsxs("li",{className:"email-data-copy flex items-start gap-2",children:[e.jsx("span",{className:"email-tone-danger mt-0.5",children:"â¢"}),e.jsx("span",{children:i})]},t))})]}),s.details.domain.domain_info?.age_days!==null&&s.details.domain.domain_info?.age_days<90&&e.jsxs("div",{className:"email-data-notice email-data-notice-warning mb-6",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-warning flex items-center gap-2",children:[e.jsx(y,{className:"w-5 h-5"})," Recently registered domain"]}),e.jsxs("p",{className:"email-data-copy mt-2",children:["This domain was registered"," ",s.details.domain.domain_info.age_days," days ago. Phishing c
2ampaigns often use newly registered domains."]})]}),s.details.domain.domain_info?.whois_error&&e.jsxs("div",{className:"email-data-notice email-data-notice-warning",children:[e.jsxs("p",{className:"email-tone-warning email-data-notice-title flex items-center gap-2",children:[e.jsx(J,{className:"w-4 h-4"})," WHOIS lookup note"]}),e.jsx("p",{className:"email-data-copy mt-2",children:s.details.domain.domain_info.whois_error})]})]})})(),(()=>{const a=s.details.links.anchor_mismatches?.length>0||s.details.links.lookalikes?.length>0||s.details.links.punycode_domains?.length>0||s.details.links.ip_urls?.length>0||s.details.links.dangerous_files?.length>0||s.details.links.open_redirects?.length>0,i=(s.checks_results||[]).filter(t=>(t.type||"").toLowerCase()==="links"&&(t.result||"").toLowerCase()==="fail").length>0||s.details.links.shorteners?.length>0||s.details.links.suspicious_hosting?.length>0||s.details.links.suspicious_params?.length>0||s.details.links.domain_analysis?.some(t=>t.findings?.length>0);return e.jsxs(z,{id:"link-analysis",title:"Links & destinations",description:`${S.urlCount??"Unknown number of"} URLs · inspect or analyze individual links`,Icon:se,tone:a?"danger":i?"warning":"neutral",onInfo:()=>T("links"),children:[e.jsxs("div",{className:"email-data-card mb-6",children:[e.jsx("p",{className:"email-data-label",children:"Total URLs found"}),e.jsx("p",{className:"email-data-stat",children:S.urlCount??"â"})]}),(()=>{const t=s.details.links,d=t.findings||[],m=[{label:"Shorteners",items:t.shorteners,render:n=>n,getUrl:n=>n,tone:"amber"},{label:"Suspicious hosting",items:t.suspicious_hosting,render:n=>`${n.service}: ${n.url}`,getUrl:n=>n.url,tone:"amber"},{label:"Suspicious URL parameters",items:t.suspicious_params?[...new Set(t.suspicious_params)]:[],render:n=>n,getUrl:n=>n,tone:"amber"},{label:"Anchor text mismatches",items:t.anchor_mismatches,render:n=>`"${n.anchor_text}" â ${n.href}`,getUrl:n=>n.href,tone:"red"},{label:"Lookalike domains",items:t.lookalikes,render:n=>n.suspicious,getUrl:n=>n.suspicious,tone:"red"},{label:"Punycode domains",items:t.punycode_domains,render:n=>n,getUrl:n=>n,tone:"red"},{label:"Bare-IP URLs",items:t.ip_urls,render:n=>n,getUrl:n=>n,tone:"red"},{label:"Links to dangerous files",items:t.dangerous_files,render:n=>typeof n=="string"?n:`${n.url} (.${n.extension})`,getUrl:n=>typeof n=="string"?n:n.url,tone:"red"},{label:"Open redirects",items:t.open_redirects,render:n=>n,getUrl:n=>n,tone:"red"}].filter(n=>n.items&&n.items.length>0),h=m.some(n=>n.tone==="red"),f=[...new Set((t.urls_found||[]).filter(n=>typeof n=="string"&&n))];if(f.length>0&&m.push({label:"All links",items:f,render:n=>n,getUrl:n=>n,tone:"slate"}),d.length===0&&m.length===0)return null;const k=h?"email-data-notice-danger":"email-data-notice-warning",F=h?"email-tone-danger":"email-tone-warning",Y=h?"email-tone-danger":"email-tone-warning";return e.jsxs("div",{className:"mb-6 space-y-3",children:[d.length>0&&e.jsxs("div",{className:`email-data-notice ${k}`,children:[e.jsxs("p",{className:`${F} email-data-notice-title flex items-center gap-2`,children:[e.jsx(y,{className:"w-4 h-4"})," Link findings"]}),e.jsx("ul",{className:"mt-2 space-y-1",children:d.map((n,q)=>e.jsxs("li",{className:"email-data-copy flex items-start gap-2",children:[e.jsx("span",{className:`${Y} mt-0.5`,children:"â¢"}),e.jsx("span",{children:n})]},q))})]}),m.map(n=>e.jsxs("details",{className:"email-link-group",children:[e.jsxs("summary",{className:"email-link-group-summary",children:[e.jsxs("span",{children:[n.label," ",e.jsxs("span",{className:"text-slate-500",children:["(",n.items.length,")"]})]}),e.jsx(We,{className:"email-link-chevron",size:16,"aria-hidden":"true"})]}),e.jsx("div",{className:"email-link-group-items",children:n.items.map((q,Pe)=>{const V=n.getUrl?n.getUrl(q):null,R=V?Ie[String(V)]:null,pe=R?.status==="submitting",xe=R?.status==="submitted",Oe=R?.status==="error",qe=!I||pe||xe;let K="Analyze",B="border-cyan-400/40 bg-cyan-500/10 text-cyan-200",U="hover:border-cyan-400 hover:bg-cyan-500 hover:text-slate-950",A="Analyze this URL with the URL Threat Analyzer";return xe?(K="Submitted",B="border-emerald-400/40 bg-emerald-500/10 text-emerald-300 cursor-default",U="",A="Already submitted"):pe?(K="Submitting",B="border-slate-700 bg-slate-800 text-slate-400 cursor-wait",U="",A="Submitting"):Oe?(K="Retry",B="border-red-400/40 bg-red-500/10 text-red-300",U="hover:bg-red-500/20",A=R.error?`${R.error}. Click to retry.`:"Click to retry"):I||(U="",A="URL Threat Analyzer unavailable"),e.jsxs("div",{className:"email-link-evidence-row",children:[V&&e.jsx("button",{type:"button",onClick:()=>De(V),disabled:qe,"aria-label":A,title:A,className:`shrink-0 inline-flex w-24 items-center justify-center rounded-md border px-2 py-1 text-[11px] font-medium transition-colors ${B} ${U} ${I?"":"opacity-50 cursor-not-allowed"}`,children:K}),e.jsx("p",{className:"email-data-copy break-all flex-1 min-w-0",children:n.render(q)})]},Pe)})})]},n.label))]})})(),s.details.links.domain_analysis&&s.details.links.domain_analysis.length>0&&e.jsxs("div",{children:[e.jsxs("p",{className:"email-data-subheading flex items-center gap-2",children:[e.jsx(fe,{className:"w-4 h-4"})," Targeted domain analysis"]}),e.jsx("div",{className:"space-y-4",children:s.details.links.domain_analysis.map((t,d)=>e.jsxs("div",{className:"email-data-card",children:[e.jsxs("div",{className:"flex flex-wrap items-start justify-between gap-3 mb-2",children:[e.jsx("p",{className:"email-data-value",children:t.domain}),t.age_days&&e.jsx("span",{className:`email-data-tag ${t.age_days<90?"email-data-tag-danger":""}`,children:t.age_days<90?"New domain":`${Math.floor(t.age_days/365)} years old`})]}),t.registrar&&e.jsxs("p",{className:"email-data-caption mb-2",children:["Registrar: ",t.registrar]}),t.findings&&t.findings.length>0?e.jsx("ul",{className:"space-y-1 mt-2",children:t.findings.map((m,h)=>e.jsxs("li",{className:"email-data-copy email-tone-danger flex items-start gap-2",children:[e.jsx(y,{className:"w-4 h-4 flex-shrink-0 mt-0.5"}),e.jsx("span",{children:m})]},h))}):e.jsxs("p",{className:"email-data-caption email-tone-success flex items-center gap-1 mt-2",children:[e.jsx(ee,{className:"w-3 h-3"}),e.jsx("span",{children:"No suspicious indicators flagged"})]})]},d))})]})]})})(),(()=>{const a=s.details.attachments?.attachments||[],l=a.some(t=>t.findings?.length>0),i=a.some(t=>t.has_macros||t.has_javascript);return e.jsxs(z,{id:"attachment-analysis",title:"Attachments",description:`${S.attachmentCount??"Unknown number of"}
2 attachments · file types and findings`,Icon:Ne,tone:l?"danger":i?"warning":"neutral",onInfo:()=>T("attachments"),children:[S.attachmentCount===null&&e.jsx("p",{className:"email-data-caption",children:"Attachment data was not provided with this report."}),S.attachmentCount===0&&e.jsxs("div",{className:"email-data-card email-attachment-empty",children:[e.jsx(Xe,{className:"email-attachment-empty-icon"}),e.jsx("p",{className:"text-slate-400",children:"This email contains no attachments"}),e.jsx("p",{className:"email-data-caption mt-1",children:"Attachments like .exe, .docm, .pdf files would be analyzed for threats"})]}),s.details.attachments?.attachment_count>0&&e.jsxs(e.Fragment,{children:[e.jsx("div",{className:"space-y-4 mb-6",children:s.details.attachments.attachments?.map((t,d)=>e.jsxs("div",{className:"email-data-card",children:[e.jsx("div",{className:"flex flex-wrap items-start justify-between gap-3 mb-2",children:e.jsx("p",{className:"email-data-value min-w-0 flex-1",children:t.filename})}),e.jsxs("p",{className:"email-data-caption mb-2",children:[t.content_type," â¢"," ",Math.round(t.size_bytes/1024),"KB"]}),t.findings&&t.findings.length>0&&e.jsx("div",{className:"mt-3 space-y-1",children:t.findings.map((m,h)=>e.jsxs("p",{className:"email-data-copy email-tone-danger flex items-start gap-2",children:[e.jsx(y,{className:"w-4 h-4 flex-shrink-0 mt-0.5"}),e.jsx("span",{children:m})]},h))}),t.has_macros&&e.jsxs("p",{className:"email-data-copy email-tone-warning mt-2 flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," Contains VBA macros"]}),t.has_javascript&&e.jsxs("p",{className:"email-data-copy email-tone-warning mt-2 flex items-center gap-2",children:[e.jsx(y,{className:"w-4 h-4"})," Contains JavaScript"]})]},d))}),s.details.attachments.findings&&s.details.attachments.findings.length>0&&e.jsxs("div",{className:"email-data-notice email-data-notice-danger",children:[e.jsxs("p",{className:"email-data-notice-title email-tone-danger mb-3 flex items-center gap-2",children:[e.jsx(H,{className:"w-5 h-5"})," Attachment threat indicators"]}),e.jsx("ul",{className:"space-y-2",children:s.details.attachments.findings.slice(0,10).map((t,d)=>e.jsxs("li",{className:"email-data-copy flex items-start gap-2",children:[e.jsx("span",{className:"email-tone-danger mt-0.5",children:"â¢"}),e.jsx("span",{children:t})]},d))})]})]})]})})(),e.jsxs("details",{id:"security-checks",className:"email-full-checklist",children:[e.jsxs("summary",{children:[e.jsx("span",{children:"All security checks"}),e.jsxs("span",{children:[S.checks.length," results · search and filter"]})]}),e.jsxs("div",{className:"email-checklist-controls",children:[e.jsxs("label",{children:[e.jsx(je,{size:16}),e.jsx("input",{type:"search","aria-label":"Search security checks",placeholder:"Search check names and descriptions",value:de,onChange:a=>ce(a.target.value)})]}),e.jsxs("select",{"aria-label":"Filter security checks",value:re,onChange:a=>oe(a.target.value),children:[e.jsx("option",{value:"all",children:"All results"}),e.jsx("option",{value:"review",children:"Needs review"}),e.jsx("option",{value:"pass",children:"Passed"}),e.jsx("option",{value:"info",children:"Informational"})]}),e.jsxs("p",{"aria-live":"polite",children:["Showing ",O.length," of ",S.checks.length," checks. Informational labels preserve the analyzerâs reported result."]})]}),e.jsx("div",{className:"divide-y divide-slate-800/50 md:hidden",children:O.map((a,l)=>{const i=ye[a.category?.toLowerCase()]||null;return e.jsx("button",{type:"button",onClick:()=>i&&E(i),className:`w-full text-left p-4 transition-colors focus:outline-none ${i?"cursor-pointer hover:bg-slate-800/40 focus:bg-slate-800/40":"cursor-default"}`,children:e.jsxs("div",{className:"flex flex-col gap-3",children:[e.jsxs("div",{className:"flex flex-wrap items-center justify-between gap-3",children:[e.jsx("span",{className:"email-data-tag",children:a.category}),ue(a)]}),e.jsxs("div",{children:[e.jsx("p",{className:"email-check-name",children:a.name}),e.jsx("p",{className:"email-data-copy mt-1",children:a.description})]})]})},l)})}),e.jsx("div",{className:"hidden overflow-x-auto md:block",children:e.jsxs("table",{className:"w-full text-left",children:[e.jsx("thead",{className:"bg-slate-950/50 text-slate-400 border-b border-slate-700/50",children:e.jsxs("tr",{children:[e.jsx(D,{label:"Category",sortKey:"category"}),e.jsx(D,{label:"Name",sortKey:"name"}),e.jsx(D,{label:"Status",sortKey:"result",className:"text-center"}),e.jsx(D,{label:"Description",sortKey:"description"})]})}),e.jsx("tbody",{className:"divide-y divide-slate-800/50",children:O.map((a,l)=>{const i=ye[a.category?.toLowerCase()]||null;return e.jsxs("tr",{onClick:()=>i&&E(i),className:`transition-colors ${i?"cursor-pointer hover:bg-slate-800/40":"hover:bg-slate-800/30"}`,children:[e.jsx("td",{className:"px-6 py-4",children:e.jsx("span",{className:"email-data-tag",children:a.category})}),e.jsx("td",{className:"px-6 py-4 font-medium text-white",children:i?e.jsxs("button",{type:"button",onClick:t=>{t.stopPropagation(),E(i)},className:"text-left hover:text-cyan-300",children:[a.name,e.jsx("span",{className:"sr-only",children:" â inspect evidence"})]}):a.name}),e.jsx("td",{className:"px-6 py-4 text-center",children:ue(a)}),e.jsx("td",{className:"px-6 py-4 text-sm text-slate-400",children:a.description})]},l)})})]})}),O.length===0&&e.jsxs("div",{className:"email-checks-empty",children:[e.jsx("p",{children:"No checks match these filters."}),e.jsx("button",{type:"button",onClick:()=>{oe("all"),ce("")},children:"Reset filters"})]})]}),e.jsxs("footer",{className:"email-report-footer",children:[e.jsxs($,{to:o.to,children:["â ",o.label]}),e.jsx($,{to:"/email-analyzer",children:"Analyze another email â"})]})]}),e.jsx(Ce,{isOpen:C.isOpen,onClose:()=>le({...C,isOpen:!1}),title:C.section?me[C.section].title:"",content:C.section?me[C.section].content:null})]})}
2export{Rs as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.