/* Delft Threat Intelligence Lab design system: tokens from its tokens.json (light = Delft Blue, dark = Delft Blue Night). */
@font-face { font-family: Archivo; src: url(fonts/Archivo-400.woff2) format("woff2"); font-weight: 400; font-display: swap; }
@font-face { font-family: Archivo; src: url(fonts/Archivo-700.woff2) format("woff2"); font-weight: 500 700; font-display: swap; }
@font-face { font-family: Archivo; src: url(fonts/Archivo-800.woff2) format("woff2"); font-weight: 800; font-display: swap; }
@font-face { font-family: "JetBrains Mono"; src: url(fonts/JetBrainsMono-400.woff2) format("woff2"); font-weight: 400; font-display: swap; }
@font-face { font-family: "JetBrains Mono"; src: url(fonts/JetBrainsMono-500.woff2) format("woff2"); font-weight: 500; font-display: swap; }

:root {
  color-scheme: light;
  --surface: #f7f5f0; --surface-raised: #ffffff; --surface-sunken: #ece8de;
  --line: #d6d0c2; --line-strong: #8a8577;
  --ink: #14213d; --ink-muted: #505a6e;
  --accent: #1d3f9e; --accent-soft: #e2e8f6; --on-accent: #ffffff;
  --signal: #a4500a; --signal-soft: #f8ead8;
  --data-1: #1d3f9e; --data-2: #b86e0e; --data-3: #2f7a74; --data-4: #9b3f67;
  --focus: #1d3f9e;
  --header-bg: #1d3f9e; --header-ink: #ffffff; --header-muted: #dbe3f7; --header-cell: #3c5ebd; --header-signal: #f0a65c;
  --landmark-red: #d7322b;
  --logo-row-dark: #1d3f9e; --logo-row-light: #8da0d8; --logo-edge-left: #2f7de1; --logo-edge-right: #2c5fc4; --header-logo-row: #5f7fd6;
}
@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) {
    color-scheme: dark;
    --surface: #0e1526; --surface-raised: #16203a; --surface-sunken: #0a101d;
    --line: #2b3858; --line-strong: #6b7aa0;
    --ink: #eef1f7; --ink-muted: #a8b1c6;
    --accent: #93acf2; --accent-soft: #1c2b57; --on-accent: #0e1526;
    --signal: #f0a65c; --signal-soft: #3a2512;
    --data-1: #93acf2; --data-2: #f0a65c; --data-3: #6fc7bd; --data-4: #e38fb4;
    --focus: #93acf2;
    --header-bg: #16203a; --header-ink: #eef1f7; --header-muted: #a8b1c6; --header-cell: #2b3d73; --header-signal: #f0a65c;
    --landmark-red: #ff6b5e;
    --logo-row-dark: #3c6fd8; --logo-row-light: #93acf2; --logo-edge-left: #5aa2f5; --logo-edge-right: #5a8ae6; --header-logo-row: #4a5f9e;
  }
}
:root[data-theme="dark"] {
  color-scheme: dark;
  --surface: #0e1526; --surface-raised: #16203a; --surface-sunken: #0a101d;
  --line: #2b3858; --line-strong: #6b7aa0;
  --ink: #eef1f7; --ink-muted: #a8b1c6;
  --accent: #93acf2; --accent-soft: #1c2b57; --on-accent: #0e1526;
  --signal: #f0a65c; --signal-soft: #3a2512;
  --data-1: #93acf2; --data-2: #f0a65c; --data-3: #6fc7bd; --data-4: #e38fb4;
  --focus: #93acf2;
  --header-bg: #16203a; --header-ink: #eef1f7; --header-muted: #a8b1c6; --header-cell: #2b3d73; --header-signal: #f0a65c;
  --landmark-red: #ff6b5e;
  --logo-row-dark: #3c6fd8; --logo-row-light: #93acf2; --logo-edge-left: #5aa2f5; --logo-edge-right: #5a8ae6; --header-logo-row: #4a5f9e;
}
:root {
  /* roles the scripts read (charts take --grid / --text-2) */
  --grid: var(--line); --text-2: var(--ink-muted);
  --sans: Archivo, "Helvetica Neue", Arial, sans-serif;
  --mono: "JetBrains Mono", ui-monospace, Menlo, monospace;
}

* { box-sizing: border-box; border-radius: 0; }
body { margin: 0; background: var(--surface); color: var(--ink); font: 400 15px/24px var(--sans); }
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
.mono, code, pre, td.mono, td.line, dl.kv dd.mono { font-family: var(--mono); font-size: 13px; line-height: 20px; }
.tnum, td.num { font-variant-numeric: tabular-nums; }

/* header band (SiteHeader, compact) */
.hdr { background: var(--header-bg); color: var(--header-ink); }
.hdr-nav { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 12px 32px;
  padding: 12px 48px; max-width: 1760px; margin: 0 auto; }
.dtl-wm { display: inline-flex; align-items: center; gap: 12px; color: var(--header-ink); text-decoration: none; }
.dtl-wm:hover { text-decoration: none; }
.dtl-wm-text { display: flex; flex-direction: column; }
.dtl-wm-name { font-weight: 800; letter-spacing: -0.02em; word-spacing: 0.06em; font-size: 20px; line-height: 22px; }
.dtl-wm-sub { font-size: 11px; line-height: 16px; font-weight: 600; color: var(--header-muted); margin-top: 2px; }
.dtl-t-dark { fill: var(--header-ink); } .dtl-t-light { fill: var(--header-logo-row); }
.dtl-t-left, .dtl-t-right { fill: var(--header-muted); } .dtl-t-red { fill: var(--landmark-red); } .dtl-t-hit { fill: var(--header-signal); }
.hdr-links { display: flex; gap: 28px; font-size: 15px; font-weight: 500; }
.hdr-links a { color: var(--header-muted); padding-bottom: 4px; border-bottom: 2px solid transparent; }
.hdr-links a:hover, .hdr-links a.on { color: var(--header-ink); border-bottom-color: var(--header-ink); text-decoration: none; }
.hdr :focus-visible { outline-color: var(--header-ink); }

/* filter bar */
.top { position: sticky; top: 0; z-index: 5; background: var(--surface-raised); border-bottom: 1px solid var(--line); }
.controls { display: flex; flex-wrap: wrap; gap: 8px 12px; align-items: center; padding: 10px 48px; max-width: 1760px; margin: 0 auto; }
.seg { display: inline-flex; border: 1px solid var(--line-strong); }
.seg button { background: var(--surface-raised); color: var(--ink); border: 0; padding: 0 12px; height: 32px; cursor: pointer;
  font: 600 13px/18px var(--sans); }
.seg button + button { border-left: 1px solid var(--line-strong); }
.seg button:hover { background: var(--surface-sunken); }
.seg button.on { background: var(--accent); color: var(--on-accent); }
.ctl, .chk { color: var(--ink-muted); font-size: 13px; font-weight: 600; display: inline-flex; gap: 6px; align-items: center; }
input, select { font: 400 13px/18px var(--sans); color: var(--ink); background: var(--surface-raised);
  border: 1px solid var(--line-strong); height: 32px; padding: 0 8px; }
input[type="checkbox"] { height: auto; accent-color: var(--accent); }
.utc { color: var(--ink-muted); font-size: 13px; }
.btn { display: inline-flex; align-items: center; font: 600 14px/20px var(--sans); height: 32px; padding: 0 16px;
  border: 1px solid var(--line-strong); background: var(--surface-raised); color: var(--ink); cursor: pointer; }
.btn:hover { background: var(--surface-sunken); }
.btn.primary, #refresh { background: var(--accent); border-color: var(--accent); color: var(--on-accent); }
.btn.primary:hover, #refresh:hover { filter: brightness(1.08); }
.btn.small { height: 28px; padding: 0 10px; font-size: 13px; }
.btn[disabled] { opacity: .45; cursor: default; }
.goip input { width: 160px; }

/* page */
main { padding: 32px 48px 64px; max-width: 1760px; margin: 0 auto; overflow-x: hidden; }
.pagehead { margin-bottom: 24px; }
.pagehead h1, .iphead h1 { margin: 0; font-size: 36px; line-height: 40px; font-weight: 700; letter-spacing: -0.02em; }
.pagehead p { margin: 8px 0 0; color: var(--ink-muted); max-width: 75ch; }
h2 { font-size: 24px; line-height: 30px; letter-spacing: -0.01em; margin: 48px 0 16px; font-weight: 700; }
h2 .hint { display: block; font: 400 14px/20px var(--sans); letter-spacing: 0; color: var(--ink-muted); margin-top: 4px; }
h3 { font-weight: 700; }
.card { background: var(--surface-raised); border: 1px solid var(--line); padding: 16px 20px; min-width: 0; overflow-x: auto; }
.sw { display: inline-block; width: 10px; height: 10px; margin: 0 6px 0 0; vertical-align: 0; }

/* KPI tiles (KeyFinding: 4px bar on top, number in Archivo 800) */
.kpis { display: grid; grid-template-columns: repeat(auto-fit, minmax(128px, 1fr)); gap: 12px; }
.kpi { background: var(--surface-sunken); border: 0; border-top: 4px solid var(--line-strong); padding: 16px; }
.kpi .lbl { color: var(--ink-muted); font-size: 13px; line-height: 18px; font-weight: 600; overflow-wrap: anywhere; }
.kpi .val { font-size: 28px; line-height: 32px; font-weight: 800; letter-spacing: -0.02em; font-variant-numeric: tabular-nums; margin-top: 8px; }
.kpi .val small { display: block; font-size: 13px; line-height: 18px; letter-spacing: 0; color: var(--ink-muted); font-weight: 400; margin-top: 4px; }

/* charts */
.charts { display: grid; grid-template-columns: repeat(auto-fit, minmax(420px, 1fr)); gap: 16px; }
.charts > .card, .grid4 > .card { min-width: 0; }
.chart h3, .card h3 { margin: 0 0 4px; font-size: 16px; line-height: 22px; }
.chart .note { color: var(--ink-muted); font-size: 13px; line-height: 18px; margin-bottom: 8px; }
.uplot, .uplot * { font-family: var(--sans); }
.uplot { color: var(--ink-muted); }
.u-legend { font-size: 13px; color: var(--ink-muted); }
.u-legend th { font-weight: 600; }
.u-select { background: color-mix(in srgb, var(--accent) 14%, transparent); }

/* tables */
.grid4 { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 16px; }
table { width: 100%; border-collapse: collapse; font-variant-numeric: tabular-nums; font-size: 14px; line-height: 20px; }
th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
th { color: var(--ink-muted); font-weight: 600; font-size: 13px; white-space: nowrap; position: sticky; top: 0; background: var(--surface-raised);
  border-bottom-color: var(--line-strong); }
th.sort { cursor: pointer; user-select: none; } th.sort:hover { color: var(--ink); }
td.num, th.num { text-align: right; }
td.trunc { max-width: 420px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
tr.click { cursor: pointer; } tr.click:hover td { background: var(--accent-soft); }
.zero { color: var(--ink-muted); }
.tbl-wrap { overflow: auto; max-height: 72vh; }
.toolbar { display: flex; flex-wrap: wrap; gap: 8px 12px; align-items: center; margin-bottom: 12px; }
.toolbar .count { color: var(--ink-muted); font-size: 13px; }

/* tags (the only round shapes) */
.badge { display: inline-flex; align-items: center; gap: 6px; height: 22px; padding: 0 10px; border-radius: 9999px; font: 600 12px/16px var(--sans);
  letter-spacing: 0.02em; white-space: nowrap; background: var(--surface-sunken); color: var(--ink); }
.badge.crit { background: var(--signal-soft); color: var(--signal); }
.badge.warn { background: transparent; box-shadow: inset 0 0 0 1px var(--line-strong); color: var(--ink-muted); }
.badge.plain { background: var(--surface-sunken); color: var(--ink); }
.tags .badge { margin: 2px 4px 2px 0; white-space: normal; word-break: break-all; height: auto; min-height: 22px; padding: 2px 10px; }

/* per-IP */
.iphead { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px 20px; }
.iphead h1.ip { font-family: var(--mono); font-weight: 500; font-size: 32px; letter-spacing: 0; }
.iphead .meta { color: var(--ink-muted); }
.sumgrid { display: grid; grid-template-columns: repeat(auto-fit, minmax(420px, 1fr)); gap: 16px; margin-top: 16px; }
dl.kv { display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 0; font-size: 14px; line-height: 20px; }
dl.kv dt { color: var(--ink-muted); } dl.kv dd { margin: 0; word-break: break-all; }

.ev td { font-size: 14px; }
.ev td.line { word-break: break-all; }
.ev tr.open td { background: var(--accent-soft); }
.detail td { background: var(--surface-sunken); padding: 16px 20px 20px; }
.detail .tabs { display: flex; gap: 8px; margin-bottom: 8px; flex-wrap: wrap; }
.detail pre { margin: 0; padding: 12px; background: var(--surface-raised); border: 1px solid var(--line);
  max-height: 520px; overflow: auto; white-space: pre-wrap; word-break: break-all; }
.detail pre.hex { white-space: pre; }
.detail .sec { margin-top: 16px; }
.detail .sec h4 { margin: 0 0 6px; font-size: 13px; line-height: 18px; color: var(--ink-muted); font-weight: 600; }
.np { color: var(--accent); background: var(--accent-soft); }
mark { background: var(--signal-soft); color: var(--signal); font-weight: 500; box-shadow: inset 0 -2px 0 var(--signal); }
.snip { margin-top: 4px; color: var(--ink-muted); white-space: pre-wrap; word-break: break-all; font-size: 12px; line-height: 18px;
  max-height: 7.5em; overflow: hidden; border-left: 1px solid var(--line-strong); padding-left: 8px; }
.txtf { display: inline-flex; flex-wrap: wrap; gap: 8px; align-items: center; }

.status { position: fixed; bottom: 16px; right: 16px; background: var(--ink); color: var(--surface); padding: 8px 14px;
  font-size: 13px; font-weight: 600; opacity: 0; transition: opacity .2s; pointer-events: none; }
.status.show { opacity: 1; }
.err { background: var(--signal-soft); color: var(--ink); border-top: 4px solid var(--signal); padding: 12px 16px; font-family: var(--mono); font-size: 13px; white-space: pre-wrap; }
.empty { color: var(--ink-muted); padding: 12px 0; }
.search-note { color: var(--ink-muted); font-size: 13px; line-height: 18px; margin-top: 10px; max-width: 110ch; }

@media (max-width: 760px) {
  .hdr-nav, .controls { padding-left: 16px; padding-right: 16px; }
  main { padding: 24px 16px 48px; }
  .charts, .grid4, .sumgrid { grid-template-columns: 1fr; }
  .ctl { flex: 1 1 100%; } .ctl input { flex: 1; }
  .goip { flex: 1 1 45%; } .goip input { width: 100%; }
  td.trunc { max-width: 180px; }
  .pagehead h1, .iphead h1 { font-size: 28px; line-height: 32px; }
  .dtl-wm-name { font-size: 17px; }
}

/* sources: honeypot fleet data-1, high-interaction honeypot data-2, both telescopes data-3, partner honeypot data-4 (always labelled) */
.sw.s1 { background: var(--data-1); } .sw.s2 { background: var(--data-2); } .sw.s3 { background: var(--data-3); } .sw.s4 { background: var(--data-4); }
.kpi.s1 { border-top-color: var(--data-1); } .kpi.s2 { border-top-color: var(--data-2); } .kpi.s3 { border-top-color: var(--data-3); }
.kpi.s4 { border-top-color: var(--data-4); } .kpi.all { border-top-color: var(--ink); }
.badge.src::before { content: ""; width: 8px; height: 8px; border-radius: 9999px; background: var(--line-strong); }
.badge.src.s1::before { background: var(--data-1); } .badge.src.s2::before { background: var(--data-2); }
.badge.src.s3::before { background: var(--data-3); } .badge.src.s4::before { background: var(--data-4); }
dl.kv dt .sw { width: 8px; height: 8px; }

/* write-up page */

.charts.one { grid-template-columns: 1fr; }
.bar { height: 10px; background: var(--accent); min-width: 1px; }
pre.md { max-height: 520px; overflow: auto; white-space: pre-wrap; background: var(--surface-sunken); padding: 12px; margin: 8px 0 0; }
td.tags .badge { white-space: nowrap; }
td code { white-space: pre-wrap; word-break: break-all; }
.grid2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(420px, 100%), 1fr)); gap: 16px; }
.asof { color: var(--ink-muted); font-size: 13px; }
#newer[hidden] { display: none; }
.access { color: var(--ink-muted); font-size: 13px; max-width: 90ch; margin: 12px 0 0; }
tr.key td { background: var(--accent-soft); }
tr.key td:first-child { box-shadow: inset 4px 0 0 var(--accent); font-weight: 600; }
tr.pub td { color: var(--ink-muted); }

/* page groups and grouped contents */
.group { margin-top: 56px; }
.group-title { font: 800 13px/16px var(--sans); letter-spacing: 0.08em; text-transform: uppercase; color: var(--accent);
  border-top: 2px solid var(--accent); padding-top: 10px; }
.group > h2:first-of-type { margin-top: 12px; }
.toc { margin-top: 16px; display: flex; flex-wrap: wrap; gap: 16px 40px; align-items: flex-start; }
.toc-groups { display: flex; flex-wrap: wrap; gap: 12px 40px; font-size: 14px; }
.toc-group { font-weight: 700; }
.toc ul { list-style: none; margin: 4px 0 0; padding: 0; }
.toc li { line-height: 22px; }
/* what they try (stacked bars, as in the scanner view) */
.blegend { display: flex; flex-wrap: wrap; gap: 4px 18px; font-size: 13px; color: var(--ink-muted); margin-bottom: 12px; }
.blegend .sw { vertical-align: -1px; }
.srow { display: grid; grid-template-columns: minmax(120px, 260px) 1fr 80px; gap: 12px; align-items: center; padding: 5px 0; }
.sbar { display: flex; gap: 2px; height: 16px; background: var(--surface-sunken); }
.sbar > * { display: block; height: 100%; min-width: 2px; }
.snum { text-align: right; font-size: 13px; color: var(--ink-muted); }
.sdiv { border-top: 1px solid var(--line); margin: 6px 0; }
.slbl { font-size: 13px; }
.bartip { position: fixed; z-index: 20; display: none; pointer-events: none; background: var(--surface-raised); color: var(--ink);
  border: 1px solid var(--line-strong); padding: 6px 10px; font-size: 13px; line-height: 18px; box-shadow: 0 4px 12px rgba(0,0,0,.15); }
.bartip .t { font-weight: 700; }
@media (max-width: 900px) { .srow { grid-template-columns: 110px 1fr 64px; } }

/* milestones: one interleaved timeline in a vertical scroll area */
.tl-wrap { max-height: 760px; overflow-y: auto; overflow-x: hidden; }
table.tl { table-layout: fixed; width: 100%; }
table.tl thead th { position: sticky; top: 0; background: var(--surface-raised); z-index: 1; }
table.tl td { vertical-align: top; overflow-wrap: break-word; }
table.tl td.when { white-space: nowrap; }
.tl-item { padding: 6px 8px; margin: 0 0 6px; }
.tl-item:last-child { margin-bottom: 0; }
.tl-item.ours { border-left: 3px solid var(--data-3); }
.tl-item.ours.click { cursor: pointer; }
.tl-item.ours.click:hover { background: var(--accent-soft); }
.tl-item.pub { border-left: 3px solid var(--line); color: var(--ink-muted); }
.tl-item.pub.key { border-left-color: var(--accent); background: var(--accent-soft); color: var(--ink); }
.tl-item .mono code { white-space: pre-wrap; word-break: break-all; }
@media (max-width: 700px) {
  table.tl colgroup, table.tl thead { display: none; }
  table.tl, table.tl tbody, table.tl tr, table.tl td { display: block; width: 100%; }
  table.tl tr { border-bottom: 1px solid var(--line); padding: 6px 0; }
  table.tl td { border: 0; padding: 2px 0; }
  table.tl td:empty { display: none; }
  table.tl td[data-side]::before { content: attr(data-side); display: block; color: var(--ink-muted); font: 600 12px/18px var(--sans); }
}
/* no horizontal scrolling anywhere: cells wrap instead */
.card { overflow-x: hidden; }
.tbl-wrap { overflow-x: hidden; }
main table { width: 100%; }
main td { overflow-wrap: break-word; }
main td.trunc { max-width: 0; }

/* data tables: fixed layout, everything wraps inside its column (inline nowrap / min-width are overridden) */
main table.dt { table-layout: auto; width: 100%; }
main table.dt td, main table.dt th { white-space: normal !important; min-width: 0 !important; max-width: none !important; overflow-wrap: break-word; }
main table.dt th { overflow-wrap: normal; }
main table.dt td.num, main table.dt td.ip, main table.dt td.when { white-space: nowrap !important; }
main table.dt td.mono:not(.ip) { word-break: break-all; }
main table .badge { white-space: normal; height: auto; min-height: 22px; }
main table.dt td.trunc { text-overflow: clip; }
/* phones: one block per row, each cell as "label: value" */
main table.dt.stacked, main table.dt.stacked tbody, main table.dt.stacked tr, main table.dt.stacked td { display: block; width: 100%; }
main table.dt.stacked thead { display: none; }
main table.dt.stacked tr { border-bottom: 1px solid var(--line); padding: 6px 0; }
main table.dt.stacked td { border: 0; padding: 2px 0; text-align: left; white-space: normal !important; }
main table.dt.stacked td::before { content: attr(data-label) ": "; color: var(--ink-muted); font: 600 12px/18px var(--sans); }
@media (max-width: 700px) { .srow { grid-template-columns: 90px 1fr 56px; } }
main .grid2 table { table-layout: fixed; width: 100%; }
main .grid2 td, main .grid2 th { white-space: normal !important; overflow-wrap: anywhere; }
table.tl tr.fix-row td { background: var(--signal-soft); }
table.tl tr.fix-row td:first-child { box-shadow: inset 4px 0 0 var(--signal); font-weight: 700; }
.fix-label { color: var(--signal); font: 800 12px/16px var(--sans); text-transform: uppercase; letter-spacing: 0.06em; margin-top: 2px; }
@keyframes flash { from { background: var(--accent-soft); } to { background: transparent; } }
table.tl tr.flash td { animation: flash 2s ease-out; }

/* page head: title, intro and contents on the left, about us on the right */
.pagehead { display: grid; grid-template-columns: minmax(0, 1fr) 300px; gap: 24px 40px; align-items: start; }
.about { background: var(--surface-raised); border: 1px solid var(--line); border-top: 4px solid var(--accent); padding: 16px 20px; }
.about h3 { margin: 0 0 6px; font-size: 16px; }
.about p { margin: 0 0 6px; color: var(--ink); max-width: none; }
.about p:last-child { margin-bottom: 0; }
.about .about-link { font-weight: 600; }
.about p { font-size: 14px; line-height: 20px; }
@media (max-width: 900px) { .pagehead { grid-template-columns: 1fr; } }
.ex-head { font-weight: 600; margin: 0 0 8px; }
.notice { margin: 12px 0 0; padding: 10px 14px; max-width: 75ch; background: var(--signal-soft); border-left: 4px solid var(--signal); color: var(--ink); font-size: 14px; line-height: 21px; }
.badge.step { height: 22px; white-space: nowrap; }
/* two-step exploitation: activity windows on one axis */
.gtrack { position: relative; height: 16px; background: var(--surface-sunken); }
.gbar { position: absolute; top: 0; height: 100%; }
.gaxis { display: flex; justify-content: space-between; font-size: 12px; color: var(--ink-muted); }
table.dt tr.step2 td:first-child { box-shadow: inset 4px 0 0 var(--signal); font-weight: 700; }

/* sticky bar: lab name and section menus once the contents list is out of view */
.bar-brand, .barnav { display: none; }
.top.scrolled .bar-brand { display: inline; font: 800 15px/20px var(--sans); color: var(--accent); letter-spacing: -0.01em; margin-right: 8px; }
.top.scrolled .barnav { display: flex; gap: 4px; flex-wrap: wrap; margin-right: auto; }
.dd { position: relative; }
.dd summary { list-style: none; cursor: pointer; font: 600 14px/20px var(--sans); padding: 4px 10px; border: 1px solid transparent; }
.dd summary::-webkit-details-marker { display: none; }
.dd summary::after { content: " \25BE"; color: var(--ink-muted); font-size: 11px; }
.dd summary:hover, .dd[open] summary { border-color: var(--line-strong); background: var(--surface-sunken); }
.dd ul { position: absolute; top: 100%; left: 0; z-index: 10; min-width: 240px; margin: 2px 0 0; padding: 6px 0; list-style: none;
  background: var(--surface-raised); border: 1px solid var(--line-strong); box-shadow: 0 6px 16px rgba(0,0,0,.15); }
.dd li a { display: block; padding: 5px 14px; font-size: 14px; color: var(--ink); }
.dd li a:hover { background: var(--accent-soft); text-decoration: none; }
.dd li a.dd-all { font-weight: 700; color: var(--accent); }
/* section headings stop below the sticky bar */
main h2[id], main section.group { scroll-margin-top: 72px; }
@media (max-width: 900px) { .top.scrolled .asof { display: none; } .top.scrolled .bar-brand { width: 100%; }
  main h2[id], main section.group { scroll-margin-top: 120px; } }
/* malware samples */
.mal-detail { padding: 4px 4px 8px; }
.mal-detail h4 { margin: 14px 0 6px; font-size: 14px; }
.mal-detail ul { margin: 0; padding-left: 20px; }
.mal-detail ul.ctx { color: var(--ink-muted); font-size: 13px; }
table.dt.mini { font-size: 13px; }
.badge.ev-seen { background: var(--accent); color: var(--on-accent); }
.badge.ev-static { background: transparent; box-shadow: inset 0 0 0 1px var(--line-strong); color: var(--ink-muted); }
.badge.ev-part { background: var(--accent-soft); color: var(--accent); }
.badge.ev-ctx { background: var(--surface-sunken); color: var(--ink-muted); }
.badge.ev-diff { background: var(--signal-soft); color: var(--signal); }
.badge.ev-live { background: var(--landmark-red); color: #fff; }