China security reports

C

China Oilfield Services Limited

cosl.com.sg

44

China Oilfield Services Limited (COSL) is a leading integrated offshore oilfield services provider primarily serving the Asian market with a global footprint. The company offers a comprehensive range of services including geophysical surveys, drilling, well services, and marine support, supported by a large fleet of vessels and advanced technical equipment. The website reflects COSL's enterprise scale and market leadership with detailed service descriptions and investor information. Technically, the website uses standard web technologies such as jQuery and JavaScript, with moderate performance and basic mobile optimization. Security posture is moderate but could be improved by implementing HTTPS enforcement and security headers. Privacy compliance is weak due to the absence of privacy and cookie policies. Overall, the website is professional and trustworthy but would benefit from enhanced security and privacy features.

网

网银在线(北京)支付科技有限公司

wangyin.com

40

The website wangyin.com represents 京东钱包, an online payment platform operated by 网银在线(北京)支付科技有限公司, a wholly owned subsidiary of 京东集团. The platform offers secure and convenient electronic payment services including mobile payments, online transfers, and fund management products. It targets 京东商城 users and the broader electronic payment market in China, positioning itself as a trusted financial service provider with extensive banking partnerships. Technically, the site uses legacy technologies such as jQuery 1.7.2 and standard HTML/CSS, with no modern frameworks detected. Performance data is incomplete, and mobile optimization is basic. Security posture is weak due to the absence of a valid SSL certificate and lack of HTTPS enforcement, despite the presence of some security headers like HSTS. Privacy compliance is partial, with a privacy policy present but no cookie consent mechanism. Business credibility is strong given the clear affiliation with 京东集团 and visible trust indicators. Overall, the site is functional but requires significant improvements in security and privacy to meet modern standards.

京

京东全球购

jd.hk

38

JD.hk operates as a major e-commerce platform specializing in cross-border and overseas shopping, targeting Chinese-speaking consumers interested in authentic global products. The platform offers a wide range of categories including mother and baby products, beauty, electronics, and luxury goods, supported by partnerships with well-known brands and stores such as Walmart and Rakuten. The website demonstrates a consistent brand presence aligned with JD.com's ecosystem, leveraging advanced front-end technologies and multiple JD.com subdomains for content delivery and user interaction. Technically, the site uses a modern JavaScript stack including jQuery, Sea.js, and JD's proprietary JMFE framework, but suffers from critical security shortcomings such as the absence of a valid SSL certificate and lack of modern TLS protocol support. Performance metrics are incomplete, and mobile optimization is basic with a redirect to a mobile subdomain. SEO and content quality are good, with clear navigation and rich product listings. From a security perspective, the lack of HTTPS and TLS support is a significant risk, exposing users to potential data interception. Security headers are minimal, and no incident response or vulnerability disclosure policies are evident. Privacy compliance is weak, with no cookie policy or consent mechanism detected, raising concerns about GDPR and other regulatory adherence. Overall, while JD.hk is a professionally designed and content-rich e-commerce platform with strong business credibility, its security posture and privacy compliance require urgent improvement to protect user data and maintain trust. Strategic recommendations include immediate SSL certificate deployment, enhanced security configurations, and implementation of comprehensive privacy policies.

W

Web2Asia

web2asia.com

40

Web2Asia is a Shanghai-based digital marketing and e-commerce agency specializing in China market entry and operations for foreign brands. They are a certified 5-Star / Gold-Star rated Tmall Partner (TP) endorsed by Alibaba, providing comprehensive services including digital strategy, e-commerce setup, performance marketing, and logistics. The company serves major international clients and operates on a Jimdo CMS platform hosted on AWS. Technically, the website uses legacy jQuery and lacks modern performance optimizations, with no valid SSL certificate currently implemented, exposing it to security risks. Privacy compliance is partial, with a cookie control mechanism present but disabled by default. Overall, the business is credible and well-positioned in the China e-commerce ecosystem but needs urgent security improvements.

长沙县聚福市场营销策划有限公司是一家位于中国湖南省长沙市长沙县的综合性企业，业务涵盖市场营销策划、数字化转型、技术咨询、人工智能硬件销售及相关制造和服务领域。公司在本地市场具有一定的知名度和影响力，提供多样化的技术和咨询服务，面向企业客户，致力于推动企业数字化升级和智能化发展。网站内容丰富，涵盖公司介绍、产品展示、服务项目及联系方式，体现了较好的业务覆盖和客户导向。技术基础较为基础，采用nginx服务器和Tailwind CSS框架，网站设计良好且移动优化表现良好，但性能数据不完整，需进一步优化加载速度和资源管理。安全方面，网站未配置有效的SSL证书，未启用HTTPS，缺少关键安全头，存在较大安全隐患，严重影响用户信任和数据安全。隐私合规方面缺乏隐私政策和Cookie政策，未体现GDPR或其他数据保护法规的遵循。整体风险较高，建议优先部署HTTPS，完善安全配置，并补充隐私合规内容以提升整体安全和合规水平。

C

CHONGQING JIANGJI DISTILLERY CO., LTD.

jiangjidistillery.com

30

Jiangji Distillery is a Chinese company specializing in the production and promotion of traditional Chinese baijiu and plum liqueur. The website presents a well-structured brand presence with detailed product categories, educational content about baijiu, and a focus on cultural heritage. The business targets consumers interested in authentic Chinese spirits and related cultural experiences. Technically, the website is built on WordPress with common plugins and uses Cloudflare as a CDN, but lacks a valid SSL certificate, which is a significant security concern. The site includes standard contact forms and social media integration, enhancing user engagement and brand reach. Security posture is weak due to missing HTTPS and incomplete security headers, while privacy compliance is minimal with only a basic privacy policy mention and no cookie consent mechanism. Overall, the website is functional and professional but requires urgent improvements in security and privacy compliance to build trust and protect users.

A

ASIAN SPORT FOR ALL ASSOCIATION

asfaa.org

32

ASFAA (Asian Sport For All Association) is a regional non-profit organization dedicated to promoting sport for all across Asia. The website serves as an information hub for news, events, programs, and publications related to ASFAA's activities. It targets sports organizations, members, and the Asian sports community, positioning itself as a key regional player affiliated with international bodies such as TAFISA. The business model focuses on community engagement and event organization rather than commercial activities. Technically, the website uses a basic technology stack including jQuery and Google Analytics, with no modern CMS or advanced frameworks detected. Performance is moderate to slow, with basic mobile optimization and accessibility. The site lacks HTTPS, which is a critical security deficiency, and no advanced security headers or policies are implemented. Privacy compliance is poor, with no visible privacy or cookie policies. From a security perspective, the absence of SSL/TLS encryption exposes visitors to risks such as data interception. The lack of security headers and email authentication records further weakens the security posture. No incident response or vulnerability disclosure mechanisms are evident. Overall, the site demonstrates a low security maturity level. The overall risk assessment indicates that while the site is functional and provides relevant content, the lack of HTTPS and privacy compliance are critical issues that must be addressed to improve trust and security. Strategic recommendations include immediate SSL implementation, adoption of privacy policies, and enhancement of security configurations to protect users and improve compliance.

开

开鲸云

kaiwhale.com

61

Kaiwhale (开鲸云) is a Chinese cloud service provider specializing in enterprise outbound cloud network management solutions. Their offerings include exclusive clean IPs for account management, AI large model computing resources, e-commerce dedicated VPS, and enterprise-grade outbound acceleration SD-WAN. The company targets enterprises engaged in cross-border e-commerce and AI computing, positioning itself as a niche cloud provider for outbound business needs. Technically, the website is built using Vue.js and PrimeVue components, hosted likely on Alibaba Cloud infrastructure. However, the site lacks a valid SSL certificate and modern TLS support, which significantly impacts its security posture. There are no advanced security headers or DNS security features implemented, and no visible contact or incident response information is provided. Overall, the business shows moderate digital maturity but requires urgent improvements in security and compliance to build trust and protect customer data.

微

微博

weibo.com

55

Weibo is a leading Chinese social media platform offering real-time information sharing, social interaction, and content discovery services. It holds a strong market position in China as a major media platform with a large user base and extensive content offerings including video and trending topics. The platform targets Chinese internet users, content creators, and social media enthusiasts, operating primarily on an advertising-driven business model. Technically, the site uses modern web technologies such as Vue.js and ECharts but suffers from slow load times and lacks a valid SSL certificate, impacting user trust and security. Security posture is moderate with proper SPF and DMARC DNS records but missing critical SSL/TLS configurations and security headers. Overall, the platform demonstrates good content quality and user experience but requires significant improvements in security and performance to enhance trust and compliance.

爱

爱跨境123

ikj123.com

47

爱跨境123 is a Chinese-language online platform focused on providing a comprehensive collection of resources, tools, and links for cross-border e-commerce and social media marketing. It serves as a curated directory for various e-commerce platforms, marketing tools, proxy services, and social media resources, targeting cross-border industry operators and advertising optimizers. The site positions itself as a valuable hub for learning and accessing essential tools for overseas traffic promotion and marketing. Technically, the website runs on nginx with PHP 7.2.33, but lacks proper SSL/TLS configuration, exposing it to security risks. It uses Baidu analytics for tracking but does not implement visible privacy or cookie policies, which may raise compliance concerns. The security posture is basic with no modern HTTPS support or advanced security headers. Overall, the site offers rich content and useful external links but requires significant improvements in security and privacy compliance to enhance trust and protect users.

S

Sunyou Group

huopan.com

59

Huopan is an international e-commerce platform originating from China, operated by Sunyou Group. It focuses on bridging global manufacturing hubs with consumer demand by offering cross-border shopping services, direct sourcing, and logistics solutions. The platform targets global consumers seeking affordable, quality Made-in-China products and aims to elevate Chinese brands internationally. Technically, the website employs standard web technologies such as nginx, jQuery, and Swiper.js, hosted likely on Alibaba Cloud infrastructure. However, the site suffers from critical SSL misconfigurations, lacking enabled TLS protocols and HSTS, which undermines secure communications. The security posture is basic with no advanced security headers or DNS security features implemented. Privacy and terms of service documents are present but basic, with no cookie consent mechanism detected. Overall, the platform demonstrates moderate digital maturity but requires urgent security improvements to protect user data and enhance trust.

S

SHENZHEN SUNYOU LOGISTICS CO., LTD.

sypost.net

53

Sunyou Logistics operates a package tracking platform at sypost.net, providing logistics tracking services primarily targeting customers who need to track shipments. The company is positioned as an established logistics provider in China with a medium-sized operation. The website offers bilingual support and basic customer service contact options including phone and email. Technically, the site uses common JavaScript libraries such as jQuery and toastr.js, and integrates Baidu Analytics for user tracking. However, the site suffers from slow load times and basic mobile optimization. Security-wise, the site has a valid SSL certificate but lacks modern TLS protocol support and essential security headers, which lowers its security posture. There is no privacy policy or terms of service published, which impacts compliance and user trust. Overall, the site is functional for its purpose but requires improvements in security, compliance, and performance to enhance trust and user experience.

天

天津云脉三六五科技有限公司

kuajingvs.com

60

天津云脉三六五科技有限公司 operates the website kuajingvs.com, branded as 跨境卫士, providing specialized security and operational solutions for cross-border e-commerce sellers. The company focuses on multi-platform account security, offering products such as a secure browser, VPS solutions, virtual number management, and AI tools to enhance operational efficiency and reduce risks of account bans. Their market position is strong within the Chinese cross-border e-commerce sector, supporting over 300 million protected stores and integrating with over 100 platforms. The website content and services target e-commerce sellers managing multiple accounts across platforms like Amazon, eBay, Shopee, and TikTok Shop.

深

深圳市顺友跨境物流股份有限公司

sypost.com

56

深圳市顺友跨境物流股份有限公司是一家成立于2008年的中国大型跨境电商物流服务商，专注于为跨境电商卖家提供国际快递、全球邮政专线、海外仓储及订单处理等综合物流解决方案。公司拥有丰富的行业经验和广泛的服务网络，日均处理包裹量超过10万件，服务超过2万家跨境电商企业，市场地位稳固。技术基础包括使用nginx服务器和jQuery等前端技术，网站性能表现良好，具备基本的移动优化和SEO策略。安全方面，网站使用有效的SSL证书，但未启用现代TLS协议和安全强化头，存在改进空间。网站实现了Cookie政策和用户同意机制，但缺乏公开的安全政策和事件响应流程。整体网站设计专业，内容丰富，导航清晰，体现出较高的用户信任度。

AGON爱攻 is a Chinese esports-focused brand specializing in gaming monitors, emphasizing high-performance products tailored for professional and enthusiast gamers. The company maintains a strong market position through sponsorships of prominent esports teams and events, reinforcing its brand presence in the competitive gaming sector. The website showcases product offerings and brand information primarily in Chinese, targeting esports players and teams. Technically, the site employs modern JavaScript frameworks such as Vue.js and UI libraries like Element UI, delivering a fast and visually appealing user experience. However, mobile optimization and accessibility are basic, and SEO practices are minimal. Security-wise, the site holds a valid SSL certificate but lacks modern TLS protocol support and essential security headers, exposing it to potential risks. There is no evidence of GDPR compliance or advanced privacy mechanisms, and no incident response or vulnerability disclosure policies are present. Overall, the site is professionally designed but requires significant security and privacy improvements to enhance trust and compliance.

AMZCFO is a specialized Chinese company focused on providing comprehensive cross-border e-commerce financial and tax compliance services. It positions itself as an industry leader offering a wide range of services including tax planning, VAT handling, domestic and overseas financial services, equity incentives, and professional training courses. The company targets cross-border e-commerce businesses and financial professionals, leveraging a professional team and partnerships to deliver integrated solutions. Technically, the website is built on modern web technologies including Express and Vue.js frameworks, with Element UI components enhancing user experience. The site is hosted on a dedicated IP with nginx and uses a valid SSL certificate, although it lacks support for modern TLS protocols, which is a security concern. Security headers like HSTS are enabled, but the presence of the 'x-powered-by' header could be reduced to improve security posture. Privacy and cookie policies are present but basic, with no explicit GDPR compliance mechanisms or consent management. Contact information is comprehensive, including phone, email, physical addresses in multiple cities, and a contact form. Overall, the website demonstrates good professionalism and trustworthiness but could improve in security and privacy compliance.

H

Haoqq导航

haoqq.com

55

Haoqq.com is a specialized website navigation platform tailored for Amazon global sellers and cross-border e-commerce participants. It aggregates a wide range of resources including keyword tools, ERP order management software, forums, media outlets, logistics, payment solutions, and educational training platforms. The site serves as a comprehensive portal to reduce information asymmetry among small and medium sellers, positioning itself as a key resource hub in the e-commerce ecosystem primarily targeting Chinese-speaking Amazon sellers. Technically, the website runs on an nginx server with PHP 5.6.30 backend, uses a valid SSL certificate issued by a recognized CA, and integrates Google Analytics and Google Adsense for tracking and advertising. However, it lacks modern TLS protocol support and security headers, and the PHP version is outdated, indicating potential security and compliance risks. The site shows good mobile optimization and SEO practices but lacks privacy and cookie policies, which may affect regulatory compliance. From a security perspective, the site has a valid SSL certificate and no known major SSL vulnerabilities but does not implement advanced security headers or modern TLS versions. There is no visible privacy policy, cookie consent mechanism, or incident response contact information, which are critical for GDPR and other data protection regulations. The absence of contact information and security policies reduces transparency and trustworthiness. Overall, haoqq.com is a valuable resource platform for its niche but requires significant improvements in security posture, privacy compliance, and transparency to enhance user trust and regulatory adherence.

TPV Technology Limited (冠捷电子科技股份有限公司) is a large enterprise specializing in the manufacturing and operation of display and audio technology products, including monitors, TVs, commercial displays, all-in-one PCs, and mobile communication devices. The company operates multiple well-known brands and maintains a strong presence in both domestic and international markets. Their website targets consumers and businesses interested in technology products and smart manufacturing solutions. Technically, the website uses common web technologies such as jQuery, Bootstrap, and Swiper for UI components, with a focus on Chinese language content and some language switching capabilities. Performance is fast and mobile optimization is good, though accessibility and SEO are basic. Security-wise, the site has a valid SSL certificate but lacks modern TLS protocols and important security headers. There is no cookie consent mechanism or detailed security policy published. Overall, the company demonstrates moderate digital maturity with room for security and compliance improvements.

H

Haoqq导航

mcds.com

46

Haoqq导航 operates as a specialized navigation portal tailored for Amazon global sellers and cross-border e-commerce practitioners. It aggregates and provides access to a wide range of resources including keyword tools, ERP systems, forums, media outlets, logistics, payment solutions, and educational platforms. The website targets primarily Chinese-speaking Amazon sellers and cross-border merchants, positioning itself as a comprehensive resource hub to bridge information gaps among sellers. Technically, the site runs on an nginx server with PHP 5.6.30, employs Google Analytics and Tag Manager for tracking, and uses a responsive design framework likely based on Bootstrap. However, the SSL certificate is invalid and mismatched, and no modern TLS protocols are enabled, indicating a weak security posture. No privacy, cookie, or terms of service policies are present, and no contact information is disclosed, which may impact user trust and compliance. The site heavily relies on external affiliate and partner links, integrating multiple third-party tools and services. Strategic improvements in security, compliance, and transparency are recommended to enhance trust and protect user data.

The website https://caifuzhongwen.com exhibits a severely deficient security posture, with critical gaps in email authentication, security headers, privacy compliance, and DNS configuration, exposing the business to significant risks including data breaches, phishing, and regulatory penalties. Immediate remediation is necessary to protect user data, maintain trust, and comply with relevant security standards and regulations.

Ant Group's website exhibits significant security and compliance gaps, particularly in security headers, GDPR compliance, and NIS2 regulatory adherence, which collectively expose the business to reputational, legal, and operational risks. While network and email security appear robust, critical security policies and protections are missing, indicating an urgent need for remediation to safeguard customer trust and regulatory standing.

The website https://huawei-pay.com exhibits a concerning security posture with multiple critical and high-severity issues, particularly in web security headers, email authentication, GDPR compliance, and incident response preparedness. The current vulnerabilities expose the business to risks including data breaches, regulatory penalties, phishing attacks, and service disruptions. Immediate remediation is necessary to protect customer data, ensure legal compliance, and maintain trust.

The website https://chinaate.com exhibits a severely insufficient security posture with numerous critical and high-risk vulnerabilities, indicating significant exposure to cyber threats and regulatory non-compliance. Key deficiencies include absence of essential security headers, lack of privacy and security policies, poor email and DNS configurations, and exposure of critical services. Immediate remediation is crucial to mitigate potential data breaches, service disruptions, and reputational damage.