dark-lord/lib/darknetAtlas.ts

import { PLACEHOLDER_ONION_URL } from "@/lib/placeholderOnion";

export type AtlasLink = {
  title: string;
  note: string;
  href: string;
};

export type AtlasSubsection = {
  name: string;
  blurb: string;
  links: AtlasLink[];
};

export type AtlasCategory = {
  id: string;
  icon: string;
  title: string;
  overview: string;
  literacy: string;
  subsections: AtlasSubsection[];
};

const P = PLACEHOLDER_ONION_URL;

/** Classroom-safe framing: taxonomy mirrors how analysts label surface types — not an endorsement or directory of real criminal services. */
function o(title: string, note: string): AtlasLink {
  return { title, note, href: P };
}

export const DARKNET_ATLAS: AtlasCategory[] = [
  {
    id: "illicit-marketplaces",
    icon: "◆",
    title: "Illicit & high-risk marketplaces",
    overview:
      "Threat intelligence and law-enforcement reporting clusters many underground storefronts under “illicit markets”: venues where vendors advertise contraband or fraud-adjacent goods. Real venues rotate constantly; names in reports are often stale.",
    literacy:
      "Students should map claims (PGP, escrow, “verified vendor”) to verifiable artifacts — never trust screenshots or forum hype alone.",
    subsections: [
      {
        name: "Narcotics & precursor chatter (simulated slots)",
        blurb: "Reporting often references opioid stimulants, novel psychoactive threads, and precursor sourcing. Placeholders only.",
        links: [
          o("Listing mirror slot — Western EU route fiction", "Replace with your case-study onion if applicable."),
          o("Bulk listing index (placeholder)", "Typical folder taxonomy in intel writeups."),
          o("Feedback escrow thread (placeholder)", "How reputation is staged in case studies."),
          o("Chemical catalog fiction slot A", "Placeholder."),
          o("Chemical catalog fiction slot B", "Placeholder."),
        ],
      },
      {
        name: "Weapons, parts & dual-use items (simulated)",
        blurb: "Analysts distinguish whole weapons vs parts, blueprints, and dual-use machining chatter.",
        links: [
          o("Parts vendor fiction index", "Placeholder .onion row."),
          o("Blueprint dump slot (placeholder)", "Use only for discussing IP / export control angles in class."),
          o("Ammo logistics rumor board (simulated)", "Placeholder."),
        ],
      },
      {
        name: "Forged & counterfeit documents (simulated)",
        blurb: "Passports, diplomas, utility bills for KYC fraud — common themes in FININT slide decks.",
        links: [
          o("Template reseller slot A", "Placeholder."),
          o("Template reseller slot B", "Placeholder."),
          o("Novelty vs fraud disclaimer fiction", "Teaching prompt: compare marketing language."),
        ],
      },
      {
        name: "Stolen financial data & fraud kits (simulated)",
        blurb: "Includes card dumps, fullz, bank logs, check templates — language from indictments, not how-to.",
        links: [
          o("CC dump forum fiction slot", "Placeholder."),
          o("Fullz aggregator placeholder", "Discuss PII sensitivity & breach notification."),
          o("Bank log rumor board (simulated)", "Placeholder."),
          o("Check & wire fraud kit fiction", "Placeholder — contrast with enterprise red-team scope."),
        ],
      },
      {
        name: "Stolen credentials & “logs” markets (simulated)",
        blurb: "Session cookies, stealer output, combo lists — often adjacent to ATO chains.",
        links: [
          o("Combo list seller fiction", "Placeholder."),
          o("Stealer log warehouse slot", "Placeholder."),
          o("Indexed cookie marketplace fiction", "Tie to MFA + device trust lessons."),
        ],
      },
    ],
  },
  {
    id: "cybercrime-services",
    icon: "⚡",
    title: "Cybercrime services & tooling",
    overview:
      "A catch-all for commoditized offense: access brokerage, malware rental, ransom panels, and denial-of-service stressors marketed as “security tests.”",
    literacy:
      "When teaching, emphasize economics (subscription tiers, support chats) and detection (C2 patterns, tariffs), not replication.",
    subsections: [
      {
        name: "Hacking-as-a-service & pentest cosplay",
        blurb: "Offers to break into mailboxes, panels, or corporate VPNs — almost always fraudulent or entangled with law enforcement stings in real life.",
        links: [
          o("HaaS storefront fiction A", "Placeholder."),
          o("HaaS storefront fiction B", "Placeholder."),
          o("“Corporate espionage” copycat slot", "Compare wording to legitimate pentest SOWs."),
        ],
      },
      {
        name: "Malware, loaders & crypters",
        blurb: "Builders, packers, and obfuscation-as-a-service show up in malware reverse-engineering courses.",
        links: [
          o("Loader subscription panel (placeholder)", "Discuss OPSEC failures of panels."),
          o("Crypter AS-a-service fiction", "Placeholder."),
          o("RAT builder archive slot", "Placeholder."),
        ],
      },
      {
        name: "Ransomware & affiliate programs",
        blurb: "RaaS branding, leak blogs, negotiation portals — curriculum ties to incident response playbooks.",
        links: [
          o("Affiliate portal fiction", "Placeholder."),
          o("Negotiation chat relay (simulated)", "Placeholder."),
          o("Decryptor rumor board (simulated)", "Highlight verify-before-pay discipline."),
        ],
      },
      {
        name: "Botnets, loaders & spam ops",
        blurb: "Panels that rent bots for click fraud, spam, or relay abuse — contrast with academic bot lab ethics.",
        links: [
          o("Botnet panel fiction slot", "Placeholder."),
          o("SMS pump relay fiction", "Placeholder."),
          o("Proxy bot reseller fiction", "Tie to provider abuse desks."),
        ],
      },
      {
        name: "DDoS, stressers & amplification kits",
        blurb: "Marketed as “stress tests”; in class, connect to BCP, scrubbing providers, and legal risk.",
        links: [
          o("Layer-7 stresser fiction", "Placeholder."),
          o("Amplification recipe mirror (simulated)", "Do not operationalize — discuss history only."),
          o("“IP booter” UI clone fiction", "Placeholder."),
        ],
      },
      {
        name: "Exploit brokers & 0-day chatter (simulated)",
        blurb: "Where legitimate research ends is a legal line — teach export controls & responsible disclosure here.",
        links: [
          o("Exploit auction fiction slot", "Placeholder."),
          o("Browser chain rumor board", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "data-leaks",
    icon: "📂",
    title: "Data leak & extortion sites",
    overview:
      "Ransomware crews and extortion actors sometimes host blogs or file dumps to pressure victims. URLs churn; many are FBI sinkholes or mirrors in training data.",
    literacy:
      "Lessons: leak authenticity, hash verification, legal obligations, and victim communication — not voyeurism.",
    subsections: [
      {
        name: "Ransomware leak blogs (simulated slots)",
        blurb: "Naming conventions often ape security blogs; compare to legitimate disclosure posts.",
        links: [
          o("Leak blog mirror A (placeholder)", "Replace for exercise."),
          o("Leak blog mirror B (placeholder)", "Replace for exercise."),
          o("Victim countdown timer fiction", "Discuss ethics of naming victims in slides."),
        ],
      },
      {
        name: "Dedicated extortion & “shame” dumps",
        blurb: "Harassment-adjacent tactics; good for talking corporate comms & mental health resources.",
        links: [
          o("Naming-and-shaming forum fiction", "Placeholder."),
          o("Partial data sampler fiction", "Placeholder."),
        ],
      },
      {
        name: "Dataset marketplaces abutting leaks",
        blurb: "Some actors sell “exclusive” archives that overlap with public breaches — tie to Have I Been Pwned literacy.",
        links: [
          o("Archive reseller slot", "Placeholder."),
          o("“Corporate pack” fiction index", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "whistleblowing",
    icon: "◎",
    title: "Whistleblowing & anonymous publishing",
    overview:
      "Legitimate confidential tip lines use hardened workflows (SecureDrop, encrypted forms). Separate that from random paste sites that claim anonymity.",
    literacy:
      "Compare source protection, legal shield laws, and newsroom infosec with “anonymous upload” scams.",
    subsections: [
      {
        name: "SecureDrop & newsroom tip lines",
        blurb: "Real organizations publish onion addresses after audit — always verify against official media sites.",
        links: [
          {
            title: "SecureDrop (official project)",
            note: "Directory of news orgs running SecureDrop — verify each org’s landing page.",
            href: "https://securedrop.org/",
          },
          o("Fictional newsroom SecureDrop slot A", "Placeholder onion — compare key verification steps."),
          o("Fictional newsroom SecureDrop slot B", "Placeholder."),
        ],
      },
      {
        name: "Anonymous tip forms & dead drops",
        blurb: "Mix of real civil-society tools and lures — teach cookie hygiene and Tor-only discipline.",
        links: [
          o("PGP-only mailbox fiction", "Placeholder."),
          o("One-time dead drop scheduler (simulated)", "Placeholder."),
          o("Whistleblower chat relay fiction", "Contrast with ephemeral messenger threat models."),
        ],
      },
      {
        name: "Publishing mirrors & censorship circumvention",
        blurb: "Some NGOs mirror banned reports via Tor; authenticity still requires out-of-band signing.",
        links: [
          o("Human-rights mirror fiction slot", "Placeholder."),
          o("Election-monitoring scrape fiction", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "privacy-services",
    icon: "🔐",
    title: "Privacy-focused services (legitimate clearnet + onion mirrors)",
    overview:
      "Many reputable privacy tools operate clearnet first; some publish Tor mirrors for censorship resistance. Teach students to verify keys and URLs from primary domains.",
    literacy:
      "No tool is magic — combine Tor Browser hygiene, account compartmentalization, and endpoint security.",
    subsections: [
      {
        name: "Encrypted email & calendar",
        blurb: "Proton and similar providers publish security models openly — contrast with “anonymous mail” scams.",
        links: [
          {
            title: "Proton (official)",
            note: "Encrypted email ecosystem — read security details on the clearnet site.",
            href: "https://proton.me/",
          },
          o("Tor mail provider mirror slot A (placeholder)", "If you add a real audited provider mirror, cite PGP proof."),
          o("Tor mail provider mirror slot B (placeholder)", "Placeholder."),
        ],
      },
      {
        name: "Privacy-oriented search",
        blurb: "Privacy-preserving search is mostly clearnet; Tor reduces local ISP visibility but not all tracker risk.",
        links: [
          {
            title: "DuckDuckGo",
            note: "Privacy-oriented search (clearnet).",
            href: "https://duckduckgo.com/",
          },
          {
            title: "Tor Project — onion services overview",
            note: "How hidden services differ from VPN marketing.",
            href: "https://www.torproject.org/",
          },
          o("SearX onion instance fiction", "Placeholder — prefer community-vetted lists."),
        ],
      },
      {
        name: "File storage & paste hygiene",
        blurb: "Onion pastebins vary wildly in ethics — discuss data retention and malware risk.",
        links: [
          o("Encrypted file locker fiction A", "Placeholder."),
          o("Encrypted file locker fiction B", "Placeholder."),
          o("Ephemeral paste fiction slot", "Contrast with corporate DLP policies."),
        ],
      },
      {
        name: "VPN discussion & abuse reporting",
        blurb: "VPNs are not anonymity panacea; .onion “review” boards are untrustworthy.",
        links: [
          o("VPN rumor board (simulated)", "Placeholder."),
          o("Provider abuse contact aggregator fiction", "Teach reading Terms + warrant canaries."),
        ],
      },
    ],
  },
  {
    id: "forums-chat",
    icon: "💬",
    title: "Forums, imageboards & chat",
    overview:
      "Underground forums organize by topic: OPSEC tradecraft, exploit research, politics, or market gossip — moderation quality is nil; sourcing is hearsay.",
    literacy:
      "Train students to read for manipulation, astroturfing, and law-enforcement artifacts.",
    subsections: [
      {
        name: "Cryptography, OPSEC & tradecraft",
        blurb: "Mix of sharp practitioners and dangerous half-truths — pair readings with formal crypto courses.",
        links: [
          o("PGP ritual bulletin fiction", "Placeholder."),
          o("Hardware token swap fiction", "Placeholder."),
          o("Tor Browser fingerprint thread fiction", "Cross-check with Tor Project docs."),
        ],
      },
      {
        name: "Exploit research & malware analysis",
        blurb: "Some boards parallel academic conf culture; legal exposure depends on jurisdiction and intent.",
        links: [
          o("RE workshop fiction slot", "Placeholder."),
          o("Sandbox telemetry gossip board", "Placeholder."),
        ],
      },
      {
        name: "Political, protest & censored speech",
        blurb: "Tor supports dissent in authoritarian contexts — distinguish from venues that glorify violence.",
        links: [
          o("Regional protest logistics fiction", "Placeholder — teach proportionality & safety planning."),
          o("Citizen journalism onion fiction", "Verify with offline networks."),
        ],
      },
      {
        name: "Market reputation & drama boards",
        blurb: "Reputation threads can be fabricated wholesale — your CyberLux forum sim explores exactly that dynamic.",
        links: [
          {
            title: "Void Aggregate (this deployment)",
            note: "Ringed forum UI on the same Next app — local persistence.",
            href: "/forum",
          },
          o("Vendor drama archaeology fiction", "Placeholder."),
          o("Scam report aggregator fiction", "Placeholder."),
        ],
      },
      {
        name: "Realtime chat & IRC adjacency",
        blurb: "Many groups still orbit IRC or Matrix bridges — onboarding should cover paste hygiene.",
        links: [
          o("Bridge relay fiction slot", "Placeholder."),
          o("Invite-only Jabber fiction", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "beyond-money-laundering",
    icon: "₿",
    title: "Money flows, mixing & OTC",
    overview:
      "Intel briefings reference tumblers, chain-hopping, gift-card arbitrage, and OTC desks — laundering is criminal; teach tracing concepts via public chain analytics instead.",
    literacy:
      "Map KYC/AML responsibilities vs privacy coin tradeoffs without glamorizing evasion.",
    subsections: [
      {
        name: "Mixers & privacy pools (fiction)",
        blurb: "Post-mixer attribution is probabilistic — discuss FATF travel rule at high level.",
        links: [
          o("Mixer directory fiction A", "Placeholder."),
          o("Mixer directory fiction B", "Placeholder."),
          o("Coinjoin education mirror fiction", "Differentiate licit privacy practice vs laundering."),
        ],
      },
      {
        name: "OTC & P2P desks (fiction)",
        blurb: "Peer listings blend honest traders with scams — escrow literacy matters.",
        links: [
          o("OTC reputation thread fiction", "Placeholder."),
          o("Stablecoin bridge chatter fiction", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "beyond-access-brokers",
    icon: "🔓",
    title: "Initial access, stealer economy & ATO supply",
    overview:
      "Initial Access Brokers sell footholds; stealer malware feeds credential pipelines — curriculum ties to detection engineering and identity threat detection.",
    literacy:
      "Focus on defender telemetry: EDR, IdP risky sign-ins, SaaS OAuth grants.",
    subsections: [
      {
        name: "Access listings (fiction)",
        blurb: "Screenshots of RDP, VPN, Citrix — reinforce MFA + vault rotation lessons.",
        links: [
          o("IAB storefront fiction", "Placeholder."),
          o("VPN session resale fiction", "Placeholder."),
        ],
      },
      {
        name: "Stealer logs & infostealer panels (fiction)",
        blurb: "MITRE techniques + Sigma rules beat bookmarking forums.",
        links: [
          o("Stealer panel fiction A", "Placeholder."),
          o("Log taxonomy cheat-sheet fiction", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "beyond-hosting",
    icon: "🖧",
    title: "Bulletproof hosting & resilient infrastructure",
    overview:
      "Abuse teams track hosts that ignore takedowns; fast-flux DNS and bulletproof rhetoric appear in incident narratives.",
    literacy:
      "Contrast with legitimate bullet-resistant journalism hosting + pro-bono CDNs.",
    subsections: [
      {
        name: "Hosting classifieds (fiction)",
        blurb: "No legitimate lab needs this — discuss peering and netblock reputation instead.",
        links: [
          o("Bulletproof reseller fiction", "Placeholder."),
          o("Fast-flux tutorial fiction (do not follow)", "Teach detection only."),
        ],
      },
    ],
  },
  {
    id: "beyond-osint",
    icon: "🔭",
    title: "OSINT, counter-OSINT & mirror hunting",
    overview:
      "Analysts monitor scam duplicates, phishing clones, and typosquatted onions — aligns with your CyberLux mirror-verification storyline.",
    literacy:
      "Fingerprint HTML, TLS certs, and PGP clearsigned canaries.",
    subsections: [
      {
        name: "Clone hunters & canary trackers (fiction)",
        blurb: "Practice verifying signed messages before trusting links.",
        links: [
          o("Mirror diff gossip board fiction", "Placeholder."),
          o("PGP watchlist fiction", "Placeholder."),
          {
            title: "CyberLux hub (verify signage in sim)",
            note: "Main storefront skin — compare sidebar claims to reality.",
            href: "/",
          },
        ],
      },
    ],
  },
  {
    id: "beyond-scams",
    icon: "⚠",
    title: "Scams, “recovery” fraud & trust games",
    overview:
      "Underground economies are dense with escrow scams, fake hitmen, and “crypto recovery” lures — ideal for behavioral econ labs.",
    literacy:
      "Red flags: urgency, private vanity proofs, impossible guarantees.",
    subsections: [
      {
        name: "Recovery & refund scams (fiction)",
        blurb: "Victims pay twice — teach reporting to FTC/FBI IC3 equivalents.",
        links: [
          o("Recovery service fiction A", "Placeholder."),
          o("Chargeback “expert” fiction", "Placeholder."),
        ],
      },
      {
        name: "Fake escrow & multisig theater (fiction)",
        blurb: "Compare multisig flows your sim shows vs real Bitcoin scripts.",
        links: [
          o("Escrow theater storefront fiction", "Placeholder."),
        ],
      },
    ],
  },
  {
    id: "beyond-nation-state",
    icon: "🌐",
    title: "Geopolitics, hacktivism & rumor ecosystems",
    overview:
      "Attribution is hard; many boards traffic speculation. Pair with formal CTI vendor reports and government advisories.",
    literacy:
      "Emphasize evidence tiers: actor aliases vs confirmed indictments.",
    subsections: [
      {
        name: "Cyber‑conflict chatterboards (fiction)",
        blurb: "Narratives skew nationalist — critical media literacy required.",
        links: [
          o("Regional conflict thread fiction A", "Placeholder."),
          o("Regional conflict thread fiction B", "Placeholder."),
        ],
      },
      {
        name: "Hacktivist ops channels (fiction)",
        blurb: "Discuss proportionality, collateral damage, and international humanitarian law at overview level.",
        links: [
          o("Ops coordination fiction", "Placeholder."),
        ],
      },
    ],
  },
];

export function atlasLinkMatchesQuery(link: AtlasLink, q: string): boolean {
  if (!q.trim()) return true;
  const s = q.toLowerCase();
  return link.title.toLowerCase().includes(s) || link.note.toLowerCase().includes(s);
}

export function atlasCategoryMatchesQuery(cat: AtlasCategory, q: string): boolean {
  if (!q.trim()) return true;
  const s = q.toLowerCase();
  if (cat.title.toLowerCase().includes(s) || cat.overview.toLowerCase().includes(s)) return true;
  return cat.subsections.some(
    (sub) =>
      sub.name.toLowerCase().includes(s) ||
      sub.blurb.toLowerCase().includes(s) ||
      sub.links.some((L) => atlasLinkMatchesQuery(L, q)),
  );
}