@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/static-html-analysis.mjs

@@ -716,4 +716,4 @@ function analyzeStaticHtml(value, options = {}) {
         inlineCharactersExamined,
     };
 }
-export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };

package/lib/structured-data-identity.mjs

@@ -6,7 +6,7 @@
 import { domainToASCII } from 'node:url';
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STRUCTURED_DATA_ENTITIES, MAX_STRUCTURED_DATA_SAME_AS_HOSTS, STRUCTURED_DATA_IDENTITY_VERSION, } from "./lookup-child-profile-contract.mjs";
-import { isUriShapedLabel } from "./portable-generator.mjs";
+import { isUriShapedLabel } from "../packages/analysis/portable-generator.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const MAX_STRUCTURED_DATA_SCRIPTS = 8;
 const MAX_STRUCTURED_DATA_SCRIPT_CHARS = 16_384;

package/lib/threat-intelligence-manifests.mjs

@@ -1,7 +1,7 @@
 import { registerCuratedConnector, registerThreatIntelligenceProvider, isCuratedConnectorDefinition, isThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { CURATED_CONNECTOR_CONTRACT_VERSION, MAX_CACHE_TTL_MS, MAX_CONNECTOR_ENTITIES, MAX_CONNECTOR_RELATIONSHIPS, MAX_RESPONSE_BYTES, MAX_TIMEOUT_MS, THREAT_INTELLIGENCE_CONTRACT_VERSION, } from "./threat-intelligence-runtime.mjs";
 import { boundedInteger, boundedHttpsUrl, enumValue, exactKeys, isRecord, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
-import { THREAT_INTELLIGENCE_CAPABILITIES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, CURATED_CONNECTOR_KINDS, CURATED_CONNECTOR_COLLECTIONS, CURATED_CONNECTOR_CREDENTIAL_MODES, CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_TARGET_EXPOSURES, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, } from "./threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_CAPABILITIES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, CURATED_CONNECTOR_KINDS, CURATED_CONNECTOR_COLLECTIONS, CURATED_CONNECTOR_CREDENTIAL_MODES, CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_TARGET_EXPOSURES, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, } from "../packages/analysis/threat-intelligence-types.mjs";
 import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const MAX_PROVIDER_ID_LENGTH = 40;
 const MAX_PROVIDER_LABEL_LENGTH = 100;

package/lib/threat-intelligence-runtime.mjs

@@ -5,7 +5,7 @@
 // output budgets before producing separately attributed normalized evidence.
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { latestObservationCohort } from "../packages/evidence/latest-observations.mjs";
-import { CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
+import { CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "../packages/analysis/threat-intelligence-types.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";

package/lib/threat-intelligence-targets.mjs

@@ -2,7 +2,7 @@
 // and curated connectors. These helpers never perform network requests.
 import { classifyQuery } from "./classify.mjs";
 import { enumValue, exactKeys, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
-import { CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_TARGET_EXPOSURES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, } from "./threat-intelligence-types.mjs";
+import { CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_TARGET_EXPOSURES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, } from "../packages/analysis/threat-intelligence-types.mjs";
 export const MAX_THREAT_INTELLIGENCE_URL_LENGTH = 2048;
 const TARGET_EXPOSURES = Object.freeze({
     domain: Object.freeze(['registrable_domain']),

package/lib/threat-intelligence-types.mjs

@@ -1,75 +1,2 @@
-// Provider-neutral types shared by threat-intelligence and curated connector
-// manifests, fixture harnesses, normalizers, and result builders.
-export const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
-export const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
-export const THREAT_INTELLIGENCE_ENVELOPE_VERSION = 1;
-export const THREAT_INTELLIGENCE_TARGET_EXPOSURES = Object.freeze([
-    'registrable_domain', 'hostname', 'origin', 'full_url',
-]);
-export const THREAT_INTELLIGENCE_CAPABILITIES = Object.freeze([
-    'domain_lookup', 'url_lookup', 'indicator_search',
-]);
-export const THREAT_INTELLIGENCE_CATEGORIES = Object.freeze([
-    'phishing',
-    'malware',
-    'spam',
-    'suspicious',
-    'abuse',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_SEVERITIES = Object.freeze([
-    'critical',
-    'high',
-    'medium',
-    'low',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_CONFIDENCES = Object.freeze([
-    'high',
-    'medium',
-    'low',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_RESULT_STATES = Object.freeze([
-    'success',
-    'partial',
-    'not_found',
-    'unsupported',
-    'skipped',
-    'rate_limited',
-    'unavailable',
-    'error',
-]);
-export const CURATED_CONNECTOR_KINDS = Object.freeze(['discovery', 'enrichment']);
-export const CURATED_CONNECTOR_COLLECTIONS = Object.freeze(['passive', 'active', 'third_party']);
-export const CURATED_CONNECTOR_CREDENTIAL_MODES = Object.freeze(['none', 'optional', 'required']);
-export const CURATED_CONNECTOR_ENTITY_VALUES = Object.freeze([
-    'domain', 'hostname', 'url', 'ipv4', 'ipv6', 'asn', 'certificate',
-]);
-export const CURATED_CONNECTOR_RELATIONSHIP_TYPES = Object.freeze([
-    'domain_resolves_to_ip', 'domain_uses_nameserver', 'domain_uses_mail_server',
-    'domain_presented_certificate', 'certificate_names_domain', 'ip_hosts_domain',
-    'domain_related_to_domain',
-]);
-export const CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS = Object.freeze(['direct', 'normalized', 'derived']);
-export const CURATED_CONNECTOR_TARGET_EXPOSURES = Object.freeze({
-    domain: Object.freeze(['registrable_domain']),
-    hostname: Object.freeze(['hostname']),
-    url: THREAT_INTELLIGENCE_TARGET_EXPOSURES,
-    ipv4: Object.freeze(['ip_address']),
-    ipv6: Object.freeze(['ip_address']),
-    asn: Object.freeze(['asn']),
-    certificate: Object.freeze(['certificate_fingerprint']),
-});
-function relationshipEndpoints(from, to) {
-    return Object.freeze({ from: Object.freeze(from), to: Object.freeze(to) });
-}
-export const CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
-    domain_resolves_to_ip: relationshipEndpoints(['domain', 'hostname'], ['ipv4', 'ipv6']),
-    domain_uses_nameserver: relationshipEndpoints(['domain'], ['hostname']),
-    domain_uses_mail_server: relationshipEndpoints(['domain'], ['hostname']),
-    domain_presented_certificate: relationshipEndpoints(['domain', 'hostname'], ['certificate']),
-    certificate_names_domain: relationshipEndpoints(['certificate'], ['domain', 'hostname']),
-    ip_hosts_domain: relationshipEndpoints(['ipv4', 'ipv6'], ['domain', 'hostname']),
-    domain_related_to_domain: relationshipEndpoints(['domain', 'hostname'], ['domain', 'hostname']),
-});
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/threat-intelligence-types.mjs";

package/lib/typosquat-generator.mjs

@@ -2,7 +2,7 @@
 // objects so a later scan can explain why each domain was generated; callers
 // that only need the historical string list can use the compatibility wrapper.
 import { advancedConfusableVariantsForAscii, confusableCharactersForAscii, estimateAdvancedConfusableVariants, MAX_ADVANCED_CONFUSABLE_VARIANTS, wholeLabelConfusableVariantsForAscii, } from "./idn-confusables.mjs";
-import { canonicalRegistrableDomain, normalizeDiscoverySuffix } from "./registrable-domain.mjs";
+import { canonicalRegistrableDomain, normalizeDiscoverySuffix } from "../packages/analysis/registrable-domain.mjs";
 import { MAX_DOMAIN_NAME_LENGTH, MAX_DOMAIN_LABEL_LENGTH } from "../packages/contracts/domain-name.mjs";
 export { MAX_ADVANCED_CONFUSABLE_VARIANTS };
 function buildKeyboardAdjacency(rows) {
@@ -775,12 +775,21 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
         const advanced = advancedConfusableVariantsForAscii(name);
         const rejectedBefore = state.rejectedVariantCount;
         let rejectedByEncoding = 0;
+        const encodedLabels = new Set();
+        let duplicatesAfterEncoding = 0;
         for (const variant of advanced.variants) {
             const ascii = toAsciiLabel(variant.unicodeLabel);
             if (!ascii) {
                 rejectedByEncoding += 1;
                 continue;
             }
+            // Different Unicode spellings can identify the same IDNA domain. They
+            // are duplicate candidates, not work omitted by a resource budget.
+            if (encodedLabels.has(ascii)) {
+                duplicatesAfterEncoding += 1;
+                continue;
+            }
+            encodedLabels.add(ascii);
             addVariant(state, ascii, 'unicode_homoglyph_depth_2');
         }
         const generated = [...state.variants.values()]
@@ -788,7 +797,7 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
             .length;
         const rejectedByValidation = state.rejectedVariantCount - rejectedBefore;
         const omittedByBudget = advanced.omittedByBudget
-            + Math.max(0, advanced.variants.length - rejectedByEncoding - rejectedByValidation - generated);
+            + Math.max(0, advanced.variants.length - duplicatesAfterEncoding - rejectedByEncoding - rejectedByValidation - generated);
         advancedConfusable = {
             generated,
             omittedByPolicy: advanced.omittedByPolicy + rejectedByEncoding + rejectedByValidation,

package/lib/website-enrichment.mjs

@@ -0,0 +1,388 @@
+// Bounded website and network enrichment, independent of registration authority.
+import { capturedWebCollectionQuality } from "../packages/evidence/collection-quality.mjs";
+import { recordOrEmpty as errorRecord } from "./json-record.mjs";
+import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { collectDnsIntelligence, skippedDnsIntelligence } from "./dns-intelligence.mjs";
+import { fetchFaviconHash } from "./favicon.mjs";
+import { extractHtmlSignals } from "./html-signals.mjs";
+import { analyzeStaticHtml } from "./static-html-analysis.mjs";
+import { featureDecision, networkFeaturePolicy } from "./feature-policy.mjs";
+import { withoutHttpDeliveryMetadata, buildHttpObservation, failedHttpObservation, skippedHttpObservation } from "./http-intelligence.mjs";
+import { collectTlsIntelligence, skippedTlsObservation } from "./tls-intelligence.mjs";
+import { analyzeWebsiteSecurityPosture } from "./website-security-posture.mjs";
+import { analyzeWebsiteTechnology, captureTechnologyResponseHeaders, } from "./website-technology.mjs";
+import { analyzeResponsePolicyHeaders, qualifyResponsePolicyWithCspMeta, } from "./response-policy.mjs";
+import { nonEmptyErrorMessage } from "./error-detail.mjs";
+import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
+import { HOMEPAGE_FETCH_TIMEOUT_MS, MAX_HOMEPAGE_BYTES, } from "./outbound-request-bounds.mjs";
+// No marketplace (Afternic/Sedo/Dan.com/GoDaddy Auctions/etc.) offers a
+// free, no-auth API to check "is this specific domain listed for sale" -
+// what's checkable without credentials is the parking/landing-page
+// nameservers and homepage copy these services actually use, which is
+// broader coverage of the same signal, not a live cross-marketplace lookup.
+const PARKING_NS_PATTERNS = [
+    /sedoparking\.com$/i,
+    /sedo\.com$/i,
+    /above\.com$/i,
+    /bodis\.com$/i,
+    /parkingcrew\.net$/i,
+    /dan\.com$/i,
+    /hugedomains\.com$/i,
+    /uniregistry/i,
+    /squadhelp/i,
+    /afternic/i,
+    /voodoo\.com$/i,
+    /fabulous\.com$/i,
+    /namedrive/i,
+    /smartname\.com$/i,
+    /domainsponsor\.com$/i,
+    /undeveloped\.com$/i,
+    /trafficz\.com$/i,
+    /dsredirection\.com$/i,
+];
+const FOR_SALE_PATH_RE = /\/(?:premium-)?domains?-for-sale(?:\/|$)/i;
+function forSaleRedirectSignal(httpObservation) {
+    if (!httpObservation || typeof httpObservation !== 'object')
+        return null;
+    const observation = httpObservation;
+    const urls = [
+        observation.finalUrl,
+        ...(Array.isArray(observation.redirects)
+            ? observation.redirects.map((redirect) => redirect && typeof redirect === 'object' ? redirect.to : null)
+            : []),
+    ];
+    for (const value of urls) {
+        if (typeof value !== 'string' || value.length > 2048)
+            continue;
+        try {
+            const url = new URL(value);
+            if (['http:', 'https:'].includes(url.protocol) && FOR_SALE_PATH_RE.test(url.pathname)) {
+                return `for-sale landing-page redirect (${url.origin}${url.pathname})`;
+            }
+        }
+        catch {
+            // Malformed retained provenance cannot establish a sale signal.
+        }
+    }
+    return null;
+}
+// Fetches enough of the homepage for the lightweight HTML signals below and
+// preserves why the probe failed. A failed request is not evidence that a
+// domain has "no site": transient DNS/TLS/network failures, a slow origin, or
+// an HTTP error can all produce the same null body. Keeping that distinction
+// avoids turning an inconclusive probe into a false inactivity claim.
+async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs = HOMEPAGE_FETCH_TIMEOUT_MS, selectedUrl, signal } = {}) {
+    const selected = selectedUrl === undefined ? null : prepareSelectedLookupUrl(selectedUrl, domain);
+    const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= HOMEPAGE_FETCH_TIMEOUT_MS
+        ? timeoutMs
+        : HOMEPAGE_FETCH_TIMEOUT_MS;
+    const headers = whoisleuthRequestHeaders();
+    const failures = [];
+    const probeStartedAt = Date.now();
+    for (const requestUrl of selected ? [selected] : [`https://${domain}`, `http://${domain}`]) {
+        signal?.throwIfAborted();
+        const scheme = new URL(requestUrl).protocol.slice(0, -1);
+        const attemptStartedAt = Date.now();
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), requestTimeoutMs);
+        try {
+            const fetched = await fetcher(requestUrl, { signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal, headers });
+            const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
+            const detail = fetched && typeof fetched === 'object' && 'response' in fetched
+                ? fetched
+                : {
+                    response: fetchedResponse,
+                    requestedUrl: requestUrl,
+                    finalUrl: requestUrl,
+                    redirectCount: 0,
+                    redirectLimitReached: false,
+                    hops: [{ url: requestUrl, status: fetchedResponse.status, location: null, durationMs: Date.now() - attemptStartedAt }],
+                    durationMs: Date.now() - attemptStartedAt,
+                };
+            const res = detail.response;
+            const analysisBase = new URL(detail.finalUrl);
+            analysisBase.search = '';
+            analysisBase.hash = '';
+            // Retain an explicitly partial prefix when the body exceeds its bound;
+            // downstream analyses must not treat it as a complete page. The
+            // timeout stays armed through this read (cleared in `finally` below,
+            // not here) - a malicious site could otherwise send headers
+            // immediately and then trickle or stall the body forever, hanging
+            // this worker with no deadline once the timer above is disarmed.
+            if (res.ok) {
+                const body = await readTextCapped(res, MAX_HOMEPAGE_BYTES, { includeSha256: true });
+                return {
+                    text: body.text,
+                    status: 'fetched',
+                    detail: `${selected ? 'Selected URL' : 'Homepage'} responded over ${scheme.toUpperCase()} (HTTP ${res.status}).`,
+                    responsePolicy: analyzeResponsePolicyHeaders(res.headers),
+                    technologyHeaders: captureTechnologyResponseHeaders(res.headers),
+                    ...(selected ? { analysisBaseUrl: analysisBase.toString() } : {}),
+                    http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
+                        previousAttempts: failures,
+                        capturedBodyBytes: body.bytesRead,
+                        bodyInspected: true,
+                        bodyTruncated: body.truncated,
+                        bodySha256: body.sha256,
+                    }),
+                };
+            }
+            // A non-2xx HTTP response still conclusively proves that a web service
+            // answered on this domain. It may block this probe (403), require auth
+            // (401), have a broken homepage route (404), or be unhealthy (5xx), but
+            // none of those are equivalent to "no website". We cannot inspect its
+            // HTML signals, so preserve a separate responded status and release the
+            // unused body.
+            await res.body?.cancel().catch(() => { });
+            return {
+                text: null,
+                status: 'responded',
+                detail: `Web server responded over ${scheme.toUpperCase()} (HTTP ${res.status}); ${selected ? 'selected page' : 'homepage'} content was not available for inspection.`,
+                responsePolicy: analyzeResponsePolicyHeaders(res.headers),
+                technologyHeaders: captureTechnologyResponseHeaders(res.headers),
+                http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
+                    previousAttempts: failures,
+                    capturedBodyBytes: 0,
+                    bodyInspected: false,
+                }),
+            };
+        }
+        catch (err) {
+            signal?.throwIfAborted();
+            const error = errorRecord(err);
+            const reason = error.name === 'AbortError'
+                ? `timed out after ${requestTimeoutMs} milliseconds`
+                : selected ? 'request failed; the selected URL was not retried at another path or scheme'
+                    : nonEmptyErrorMessage(err, 'request failed')
+                        .replace(/[\u0000-\u001f\u007f]+/g, ' ')
+                        .slice(0, 180);
+            failures.push({ url: requestUrl, error: `${scheme.toUpperCase()} ${reason}` });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    return {
+        text: null,
+        status: 'inconclusive',
+        detail: failures.length
+            ? `Could not confirm ${selected ? 'selected URL' : 'homepage'} activity: ${failures.map((attempt) => attempt.error).join('; ')}.`
+            : 'Could not confirm homepage activity.',
+        http: failedHttpObservation(failures, { durationMs: Date.now() - probeStartedAt }),
+    };
+}
+function deriveWebsiteActivity(homepageStatus, hasFavicon, alreadyParked = false) {
+    if (alreadyParked)
+        return 'parked';
+    if (homepageStatus === 'fetched' || homepageStatus === 'responded' || hasFavicon)
+        return 'active';
+    return 'unreachable';
+}
+async function enrichWebsite(context, options, featurePolicy) {
+    const { domain, observationHostname, selectedUrl, registration, registryDnsEvidence, nameservers, dnssec } = context;
+    const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
+    const collectDns = options.collectDnsIntelligence || collectDnsIntelligence;
+    const collectTls = options.collectTlsIntelligence || collectTlsIntelligence;
+    const fetchHomepageForDomain = options.fetchHomepage || fetchHomepage;
+    const fetchFaviconForDomain = options.fetchFaviconHash || fetchFaviconHash;
+    const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
+    const tlsIntelligenceEnabled = featureDecision('tls_intelligence', featurePolicy).enabled;
+    const deepScanComplete = ['rdap', 'whois', 'dns_intelligence', 'website_probe', 'tls_intelligence']
+        .every((feature) => featureDecision(feature, featurePolicy).enabled);
+    // Registered - look for for-sale/parked/website signals (homepage fetch,
+    // deep mode only), and check for a configured mail exchanger as a
+    // phishing-risk signal (a lookalike domain that can receive/send mail is
+    // capable of running credential-harvesting or BEC campaigns).
+    const nsSignal = registration.state === 'registered' ? nameservers.find((ns) => PARKING_NS_PATTERNS.some((re) => re.test(ns))) : undefined;
+    let forSaleSignal = nsSignal ? `parking nameserver (${nsSignal})` : null;
+    let activityStatus = nsSignal && observationHostname === domain ? 'parked' : 'unknown';
+    // Homepage + bounded DNS evidence resolve in parallel; the favicon fetch is sequenced after
+    // the homepage so it can use any <link rel="icon"> the page declares (many
+    // sites serve no /favicon.ico and only point to a CDN PNG this way). One
+    // extra round-trip on the already-slow deep path, in exchange for finding
+    // favicons the bare /favicon.ico probe would miss.
+    const [homepage, dnsIntelligence, tlsIntelligence] = await Promise.all([
+        websiteProbeEnabled ? fetchHomepageForDomain(observationHostname, {
+            ...(selectedUrl ? { selectedUrl } : {}), ...(options.signal ? { signal: options.signal } : {}),
+        }).catch((err) => ({
+            text: null,
+            status: 'inconclusive',
+            detail: selectedUrl ? 'Could not confirm selected URL activity.'
+                : `Could not confirm homepage activity: ${String(err && err.message ? err.message : 'request failed').slice(0, 180)}.`,
+            http: failedHttpObservation([
+                { url: selectedUrl ?? `https://${observationHostname}`, error: selectedUrl ? 'request failed' : String(err && err.message ? err.message : 'request failed') },
+            ]),
+        })) : Promise.resolve({
+            text: null,
+            status: 'skipped',
+            detail: 'Website probing is disabled by deployment policy.',
+            http: skippedHttpObservation(),
+        }),
+        dnsIntelligenceEnabled
+            ? collectDns(observationHostname, {
+                ...(options.dnsResolvers ? { resolvers: options.dnsResolvers } : {}),
+                includeExtendedContext: options.includeExtendedDnsContext === true,
+                includeInheritedCaa: options.includeInheritedCaa === true,
+                registryEvidence: registryDnsEvidence,
+                ...(observationHostname !== domain ? { registrationDomain: domain } : {}),
+            })
+            : Promise.resolve(skippedDnsIntelligence('DNS intelligence is disabled by deployment policy.', {
+                includeExtendedContext: options.includeExtendedDnsContext === true,
+                includeInheritedCaa: options.includeInheritedCaa === true,
+            })),
+        tlsIntelligenceEnabled
+            ? collectTls(observationHostname)
+            : Promise.resolve(skippedTlsObservation()),
+    ]);
+    options.signal?.throwIfAborted();
+    const page = homepage.text;
+    const pageBaseUrl = homepage.analysisBaseUrl ?? (typeof homepage.http?.finalUrl === 'string' ? homepage.http.finalUrl : `https://${observationHostname}/`);
+    let pageAnalysis = page ? analyzeStaticHtml(page, { baseUrl: pageBaseUrl, includeVisibleText: true }) : undefined;
+    let htmlSignals = {
+        domainSaleSignal: null,
+        pageTitle: null,
+        hasPasswordField: false,
+        phishingLanguageMatch: null,
+        hasExternalFormAction: null,
+        externalAssetHosts: [],
+        cspMetaPolicy: null,
+        pageIdentity: null,
+        credentialSurfaceProfile: null,
+        structuredDataIdentity: null,
+        technologyProfile: null,
+        pageRoleProfile: null,
+        clientBehaviorProfile: null,
+    };
+    if (homepage.status === 'fetched') {
+        if (page) {
+            const responseContentType = homepage.http?.response?.contentType;
+            const pageIdentityEligible = typeof responseContentType !== 'string'
+                || responseContentType.trim() === ''
+                || /^(?:text\/html|application\/xhtml\+xml)(?:\s*;|$)/i.test(responseContentType.trim());
+            htmlSignals = await extractHtmlSignals(page, observationHostname, {
+                ...(options.signal ? { signal: options.signal } : {}),
+                ...(pageAnalysis ? { htmlAnalysis: pageAnalysis } : {}),
+                baseUrl: pageBaseUrl,
+                ...(typeof homepage.http?.observedAt === 'string' ? { observedAt: homepage.http.observedAt } : {}),
+                sourceTruncated: homepage.http?.response?.bodyTruncated === true,
+                exactBodyHash: homepage.http?.response?.bodyHash,
+                httpServer: homepage.http?.response?.server,
+                responseHeaders: homepage.technologyHeaders,
+                activityStatus,
+                includePageIdentity: pageIdentityEligible,
+                includePublicationMetadata: options.includePublicationMetadata !== false,
+                ...(options.includeCredentialSurfaceProfile !== undefined
+                    ? { includeCredentialSurfaceProfile: options.includeCredentialSurfaceProfile }
+                    : {}),
+                ...(options.includeStructuredDataIdentity !== undefined
+                    ? { includeStructuredDataIdentity: options.includeStructuredDataIdentity }
+                    : {}),
+                ...(options.includeTechnologyProfile !== undefined
+                    ? { includeTechnologyProfile: options.includeTechnologyProfile }
+                    : {}),
+            });
+            if (pageIdentityEligible && htmlSignals.domainSaleSignal) {
+                if (!selectedUrl && observationHostname === domain)
+                    forSaleSignal = forSaleSignal || htmlSignals.domainSaleSignal;
+                activityStatus = 'parked';
+            }
+        }
+    }
+    if (options.includeTechnologyProfile !== false && htmlSignals.technologyProfile === null
+        && ['fetched', 'responded'].includes(homepage.status)) {
+        htmlSignals.technologyProfile = await analyzeWebsiteTechnology({
+            ...(options.signal ? { signal: options.signal } : {}),
+            htmlAvailable: false,
+            httpServer: homepage.http?.response?.server,
+            responseHeaders: homepage.technologyHeaders,
+            observedAt: homepage.http?.observedAt,
+        });
+    }
+    // Complete document consumers before an optional network wait. Only the
+    // small icon projection, not every parsed element/token, crosses that wait.
+    const faviconEvidence = pageAnalysis ? {
+        iconLinks: pageAnalysis.iconLinks, effectiveBaseUrl: pageAnalysis.effectiveBaseUrl,
+    } : undefined;
+    const pageCollectionComplete = homepage.status === 'fetched' && homepage.http?.complete === true
+        && homepage.http.response?.bodyTruncated !== true && Boolean(pageAnalysis)
+        && !pageAnalysis?.inputLimitReached && !pageAnalysis?.tagLimitReached
+        && !pageAnalysis?.visibleTextLimitReached && !pageAnalysis?.forms.truncated;
+    pageAnalysis = undefined;
+    const favicon = websiteProbeEnabled
+        ? await fetchFaviconForDomain(observationHostname, {
+            baseUrl: pageBaseUrl, ...(faviconEvidence ? { htmlAnalysis: faviconEvidence } : {}),
+        }).catch(() => null)
+        : null;
+    const faviconHash = favicon ? favicon.hash : null;
+    const faviconPHash = favicon ? favicon.phash : null;
+    const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
+    const retainedHttp = options.includeDeliveryMetadata === false
+        ? withoutHttpDeliveryMetadata(homepage.http)
+        : homepage.http;
+    const { cspMetaPolicy: _cspMetaPolicy, domainSaleSignal: _domainSaleSignal, ...retainedHtmlSignals } = htmlSignals;
+    const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
+        http: homepage.http,
+        responsePolicy,
+        pageIdentity: htmlSignals.pageIdentity,
+        tls: tlsIntelligence,
+        dns: dnsIntelligence,
+        dnssec,
+        observedAt: homepage.http?.observedAt,
+    });
+    const redirectSaleSignal = forSaleRedirectSignal(homepage.http);
+    if (!selectedUrl && observationHostname === domain && !forSaleSignal && redirectSaleSignal) {
+        forSaleSignal = redirectSaleSignal;
+        activityStatus = 'parked';
+    }
+    const faviconProvedActive = !selectedUrl && homepage.status === 'inconclusive' && Boolean(favicon);
+    const websiteProbeStatus = faviconProvedActive ? 'responded' : homepage.status;
+    const websiteProbeDetail = faviconProvedActive
+        ? `${homepage.detail} A favicon responded successfully, confirming an active web service.`
+        : homepage.detail;
+    if (websiteProbeEnabled) {
+        activityStatus = deriveWebsiteActivity(homepage.status, !selectedUrl && Boolean(favicon), activityStatus === 'parked');
+    }
+    const registrationResult = registration.state !== 'registered' ? registration
+        : !forSaleSignal ? {
+            ...registration,
+            detail: 'source' in registration && registration.source === 'dns'
+                ? 'Authoritative DNS delegation confirms the domain is registered, but RDAP/WHOIS registration details were unavailable.'
+                : selectedUrl ? 'The domain is registered. Website observations concern the explicitly selected URL.'
+                    : observationHostname === domain ? 'Domain is registered and shows no for-sale signals.'
+                        : 'The domain is registered. Website observations concern the separately identified hostname.',
+        } : {
+            ...registration,
+            state: 'for_sale',
+            confidence: 'medium',
+            detail: `Detected a for-sale listing (${forSaleSignal}).`,
+        };
+    return {
+        ...registrationResult,
+        activityStatus,
+        websiteProbeStatus,
+        websiteProbeDetail,
+        http: retainedHttp,
+        ...(options.observationHostname !== undefined || selectedUrl ? { observationHostname } : {}),
+        ...(selectedUrl ? { webObservationMode: 'selected_url' } : {}),
+        deepScanComplete,
+        webCollectionQuality: capturedWebCollectionQuality(!websiteProbeEnabled ? 'not_collected' : pageCollectionComplete ? 'complete'
+            : homepage.status === 'fetched' ? 'partial' : 'unavailable', 
+        // The bounded favicon collector returns no result for both failed and
+        // non-image candidates. A miss therefore cannot prove an icon was removed.
+        !websiteProbeEnabled ? 'not_collected' : favicon ? 'complete' : 'unknown'),
+        faviconHash,
+        faviconPHash,
+        ...retainedHtmlSignals,
+        securityPosture,
+        nameservers: nameservers.length || observationHostname !== domain ? nameservers : dnsIntelligence.records.ns,
+        dns: dnsIntelligence,
+        tls: tlsIntelligence,
+        hasMx: dnsIntelligence.hasMx,
+        hasNullMx: dnsIntelligence.hasNullMx,
+        mxHosts: dnsIntelligence.mxHosts,
+        hasSpf: dnsIntelligence.hasSpf,
+        hasDmarc: dnsIntelligence.hasDmarc,
+    };
+}
+export { enrichWebsite, fetchHomepage, deriveWebsiteActivity, forSaleRedirectSignal };

package/lib/whois-authority.mjs

@@ -2,6 +2,8 @@
 // registry response referred by IANA can decide existence; later registrar
 // output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
+import { domainToASCII } from 'node:url';
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
 const LINE_NOT_FOUND_PATTERNS = Object.freeze([
     /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no match(?:[ \t]+for(?:[ \t]+domain)?(?:[ \t]+["']?[a-z0-9.-]{1,253}["']?)?)?[.!]?[ \t]*$/im,
@@ -50,7 +52,41 @@ export function hasNicKgRegistrationEvidence(text) {
         && /^[ \t]*Record created[ \t]*:[ \t]*\S/im.test(text)
         && /^[ \t]*Name servers in the listed order[ \t]*:[ \t]*$/im.test(text);
 }
-function classifyHopEvidence(hop, index) {
+function canonicalObjectName(value) {
+    const name = domainToASCII(value.trim().replace(/^["']|["'.]+$/gu, '')).toLowerCase();
+    return isValidAsciiHostname(name) ? name : null;
+}
+/** An echoed object may qualify this response, never a different query. */
+export function whoisResponseMatchesDomain(text, requestedDomain) {
+    const expected = canonicalObjectName(requestedDomain);
+    if (!expected)
+        return false;
+    const identityPatterns = [
+        /^[ \t*]*(?:domain(?:[ \t]+name)?|domain_name|domainname)[ \t.]*:[ \t]*(\S[^\r\n]*)$/gimu,
+        /^[ \t]*\[Domain Name\][ \t]*(\S[^\r\n]*)$/gimu,
+        /^[ \t]*Domain[ \t]+([^\s()]+)[ \t]+\([A-Z][A-Z0-9_-]*\)[ \t]*$/gmu,
+        /^[ \t]*Domain(?: name)?[ \t]*:[ \t]*\r?\n(?:[ \t]*\r?\n)*[ \t]+(?:name:[ \t]*)?(\S[^\r\n]*)$/gimu,
+    ];
+    for (const pattern of identityPatterns) {
+        for (const match of text.matchAll(pattern)) {
+            // A few registries publish Unicode plus its parenthesised ASCII form.
+            const names = (match[1] ?? '').split(/[ \t()]+/u).filter(Boolean);
+            if (!names.length || names.some(name => canonicalObjectName(name) !== expected))
+                return false;
+        }
+    }
+    for (const pattern of LINE_NOT_FOUND_PATTERNS) {
+        for (const match of text.matchAll(new RegExp(pattern.source, `${pattern.flags}g`))) {
+            const names = match[0].match(/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.?/giu) ?? [];
+            if (names.some(name => canonicalObjectName(name) !== expected))
+                return false;
+        }
+    }
+    // Known complete negative line formats without an echoed name retain their
+    // existing meaning only within the exact IANA-referred registry response.
+    return true;
+}
+function classifyHopEvidence(hop, index, requestedDomain) {
     if (hop.error)
         return 'error';
     const text = hop.response || '';
@@ -60,6 +96,8 @@ function classifyHopEvidence(hop, index) {
         return 'rate_limited';
     if (NZ_TEMPORARY_FAILURE_RE.test(text))
         return 'rate_limited';
+    if (index > 0 && requestedDomain !== undefined && !whoisResponseMatchesDomain(text, requestedDomain))
+        return 'inconclusive';
     if (NZ_NOT_FOUND_RE.test(text))
         return 'negative';
     if (LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
@@ -95,12 +133,12 @@ function ianaRegistryReferral(hop) {
     }
     return null;
 }
-export function analyzeWhoisChainAuthority(chain) {
+export function analyzeWhoisChainAuthority(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
         server: hop.server,
         index,
-        kind: classifyHopEvidence(hop, index),
+        kind: classifyHopEvidence(hop, index, requestedDomain),
     }));
     const failed = evidence.filter((item) => item.kind === 'error' || item.kind === 'rate_limited');
     const registryReferral = ianaRegistryReferral(source[0]);
@@ -135,11 +173,11 @@ export function analyzeWhoisChainAuthority(chain) {
     };
 }
 /** Collection status shared by final and incremental Lookup presentation. */
-export function whoisCollectionStatus(chain) {
+export function whoisCollectionStatus(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     if (!source.length || source[0]?.error)
         return 'error';
     if (source.length === 1)
         return 'unsupported';
-    return analyzeWhoisChainAuthority(source).chainStatus;
+    return analyzeWhoisChainAuthority(source, requestedDomain).chainStatus;
 }