// URL analysis rules and patterns
export const urlRules = {
  // Suspicious domain patterns
  domainPatterns: [
    /^(?!www\.)[a-zA-Z0-9-]+\.(com|net|org|edu|gov)$/i,  // Single word domains
    /^[0-9]+\.(com|net|org|edu|gov)$/i,                   // Numeric domains
    /^[a-zA-Z0-9-]+\.(tk|ml|ga|cf|gq)$/i,                // Free domain TLDs
    /^[a-zA-Z0-9-]+\.(xyz|top|cc|club)$/i,               // Suspicious TLDs
  ],

  // Suspicious URL patterns
  urlPatterns: [
    /\/login\/?$/i,
    /\/signin\/?$/i,
    /\/account\/?$/i,
    /\/verify\/?$/i,
    /\/confirm\/?$/i,
    /\/update\/?$/i,
    /\/secure\/?$/i,
    /\/security\/?$/i,
  ],

  // Suspicious query parameters
  queryParams: [
    'login',
    'password',
    'account',
    'verify',
    'confirm',
    'update',
    'secure',
    'security',
    'credential',
    'auth',
    'token',
    'key',
  ],

  // Common phishing targets
  targetDomains: [
    'google.com',
    'microsoft.com',
    'apple.com',
    'amazon.com',
    'paypal.com',
    'facebook.com',
    'twitter.com',
    'linkedin.com',
    'github.com',
    'dropbox.com',
  ],

  // Suspicious redirect patterns
  redirectPatterns: [
    /^https?:\/\/[^\/]+\/[^\/]+\/[^\/]+$/i,  // Multiple path segments
    /^https?:\/\/[^\/]+\/[^\/]+$/i,          // Two path segments
  ],

  // Weighting system for risk assessment
  weights: {
    domainPattern: 2,
    urlPattern: 1,
    queryParam: 1,
    targetDomain: 3,
    redirectPattern: 2,
  },

  // Risk thresholds
  thresholds: {
    high: 5,
    medium: 3,
    low: 1,
  }
}; 