Turkey security reports

LookUs Scientific is a technology company specializing in academic and scientific event management solutions, online article management, and association management systems. Established in 1999, it serves academic institutions, scientific organizations, and M.I.C.E professionals primarily in Turkey. The company offers a suite of software products including JournalAgent™, AbstractAgent™, and online congress platforms, positioning itself as a trusted provider in the scientific community. Technically, the website uses modern web technologies such as Bootstrap and jQuery, with Google Analytics integrated for visitor tracking. The site is mobile responsive and professionally designed, though some SEO and accessibility features could be improved. Security posture is moderate with cookie consent implemented but lacks visible security headers and published privacy or security policies. The absence of WHOIS registration data raises concerns about domain legitimacy and requires further verification. Overall, the website is functional and professional but would benefit from enhanced transparency and security practices.

L

LookUs Scientific Inc.

eco2026.org

57

The website eco2026.org serves as the official platform for the 33rd European Congress on Obesity scheduled for May 2026 in Istanbul, Turkey. It provides comprehensive information about the congress including registration, accommodation, scientific program, and general details. The target audience primarily consists of healthcare professionals, researchers, and academics interested in obesity research and treatment. The business model revolves around event organization and information dissemination within the healthcare sector, specifically obesity research. The site is professionally designed with consistent branding and clear navigation, supporting a good user experience.

The website eco2025.org serves as the official platform for the 33rd European Congress on Obesity scheduled for May 2025 in Istanbul, Turkey. It provides comprehensive information about the event including registration, accommodation, scientific programs, and important dates. The site targets healthcare professionals, researchers, and stakeholders in obesity research and treatment, positioning itself as a reputable event within the European healthcare conference market. The business model centers on event organization and scientific knowledge dissemination, supported by sponsorship and exhibition opportunities. Technically, the website employs a modern tech stack including Bootstrap 5, jQuery, Font Awesome, and Google Analytics, hosted behind Cloudflare DNS services. The site is mobile-optimized with good SEO practices and basic accessibility features. It integrates Google Translate for multilingual support and uses cookie consent mechanisms to comply with privacy regulations. From a security perspective, the site enforces HTTPS and uses Google Tag Manager asynchronously, but lacks DNSSEC and explicit security headers such as CSP or HSTS. No vulnerability disclosure or incident response contacts are provided, which could be improved. The WHOIS data shows privacy protection but aligns reasonably with the event's nature and timeline, indicating legitimacy. Overall, the website demonstrates a solid digital presence with good content quality and business credibility. Security posture is adequate but can be enhanced by implementing DNSSEC, security headers, and publishing security policies. Privacy compliance is basic but present. The site is safe for general audiences and free from suspicious or malicious content.

B

Bonus Veren Siteler

bonus-deneme-siteler.com

56

Bonus Veren Siteler is a Turkish online platform specializing in aggregating and presenting legal and reliable bonus offers, promotional codes, and free trial opportunities primarily for e-commerce and digital services. The website targets online shoppers and users seeking to maximize savings and benefits through verified promotions. The business operates as an informational and affiliate-style service, focusing on providing up-to-date and trustworthy content to its audience. The market position is niche with a focus on the Turkish market, emphasizing legal compliance and user trust. Technically, the website employs modern web standards including HTML5, CSS3, and JavaScript, with external resources such as Google Fonts and Font Awesome. Hosting and DNS services are managed via Cloudflare, enhancing performance and security. The site is mobile-optimized with responsive design and basic accessibility features. SEO practices are well implemented with comprehensive meta tags and structured data (JSON-LD) for enhanced search engine visibility. From a security perspective, the site uses HTTPS and has domain transfer protections enabled. However, it lacks advanced security headers and does not publish privacy or cookie policies, which are important for GDPR compliance and user trust. No incident response or vulnerability disclosure information is provided. The WHOIS data presents a suspicious domain creation date in the future, which undermines trust and requires further verification. No forms or user data collection mechanisms are present on the main page, reducing immediate privacy risks. Overall, the website is professionally designed and functional with good content quality and user experience. The main risks relate to compliance gaps (missing privacy and cookie policies) and the questionable WHOIS domain registration data. Strategic improvements in these areas would enhance trustworthiness and security posture.

D

DoktorTakvimi

doktortakvimi.com

68

DoktorTakvimi is a prominent Turkish online healthcare platform specializing in doctor search, appointment booking, and patient reviews. It operates as part of the Docplanner group, a recognized leader in healthcare technology. The website offers a comprehensive database of over 181,000 doctors and specialists, facilitating easy access to healthcare services for patients in Turkey. The platform supports online consultations and integrates modern digital tools to enhance user experience. Technically, the site employs a robust tech stack including JavaScript frameworks, Algolia search, Google Analytics, and HubSpot marketing tools, ensuring efficient performance and user engagement. Security measures such as HTTPS enforcement, security headers, and cookie consent mechanisms are well implemented, although explicit security policies and incident response details are not publicly available. The absence of WHOIS registration data is a notable anomaly but does not detract significantly from the platform's legitimacy given its professional presentation and market presence. Overall, DoktorTakvimi demonstrates a mature digital infrastructure with good privacy compliance and a strong market position in Turkey's healthcare sector.

K

Kitab-ı Mukaddes Şirketi

kitabimukaddes.com

46

Kitab-ı Mukaddes Şirketi operates as a niche e-commerce retailer specializing in Bible translations and Christian religious publications, targeting a primarily Turkish-speaking Christian audience. The website offers a catalog of religious books, e-books, and related Christian literature, positioning itself as a specialized provider in this market segment. The business model is focused on direct online sales through an e-store platform, leveraging multilingual support and multiple currency options to cater to a broader audience. The company appears to be a small-sized entity based in Turkey, with a consistent brand presence and a professional website design.

T

Travesti Modeller

ankaratravestimodeller.com

51

The website 'Travesti Modeller' serves as a niche content portal focused on showcasing travesti models and related community content in Ankara, Turkey. It targets an adult audience interested in this specific cultural and social segment. The site is built on WordPress with common SEO and UI plugins, indicating a moderate level of digital maturity. It uses Google Analytics for visitor tracking but lacks explicit privacy and cookie policies, which is a compliance gap. Security posture is moderate with HTTPS enabled but missing advanced security headers and incident response information. The domain WHOIS data is missing, raising concerns about domain legitimacy and trustworthiness. Overall, the site is functional and content-rich but requires improvements in privacy, security, and business transparency to enhance trust and compliance.

K

Kadıköy Travesti

kadikoy-travesti.com

54

Kadıköy Travesti is a niche online community platform serving the travesti and LGBTİ+ individuals primarily in the Kadıköy district of Istanbul, Turkey. The website offers a digital space for social networking, event announcements, and safe communication, emphasizing real profiles and community solidarity. The platform operates on WordPress with modern plugins such as Elementor and Yoast SEO, and integrates Google Analytics for visitor tracking. While the site is well-structured and content-rich, it lacks explicit privacy and cookie policies, and no WHOIS registration data is available for the domain, which raises concerns about domain legitimacy. The platform provides a phone contact and physical address, enhancing business credibility.

İ

İstanbul Travesti Portalı

istanbultravestii.com

55

İstanbul Travesti Portalı is a niche community website dedicated to the travesti community in Istanbul, providing profiles, cultural articles, event information, and support resources. The platform positions itself as a safe and inclusive space for travesti individuals to connect and share experiences. Technically, the site is built on WordPress with common SEO and analytics tools, showing moderate performance and good mobile optimization. Security posture is adequate with HTTPS enabled but lacks advanced security headers and explicit privacy/cookie policies, which are areas for improvement. The absence of WHOIS registrant data reduces domain trustworthiness, though the site content and contact information support its legitimacy. Overall, the site serves a specialized community with a focus on cultural and social engagement.

I

Istanbul Agop Cymbals

istanbulcymbals.com

63

Istanbul Agop Cymbals is a well-established manufacturer and retailer of handcrafted cymbals with a rich history dating back to at least 1997, as evidenced by their domain registration. The company targets musicians, drummers, and music retailers, offering a range of traditional and modern cymbal series, artist endorsements, and dealer support. Their market position is strong within the musical instrument manufacturing and retail sector, supported by a consistent brand presence and active social media engagement. Technically, the website is built on WordPress with modern libraries such as jQuery and FontAwesome, providing a good user experience with mobile optimization and clear navigation. Hosting is provided by GoDaddy, and the site uses HTTPS with a valid SSL certificate, although DNSSEC is not enabled. Performance is moderate, and accessibility is basic but functional. From a security perspective, the site has room for improvement. While HTTPS is enforced and domain locks are in place, there is a lack of security headers and no DNSSEC, which could enhance DNS security. Privacy compliance is limited, with no visible cookie consent mechanism or comprehensive privacy policy addressing GDPR. Contact information is clearly provided, but no incident response or security policy details are published. Overall, the website is professional, trustworthy, and serves its business purpose well, but it should enhance its security posture and privacy compliance to meet modern standards and regulatory requirements.

The website demellos.com serves as a Turkish-language guide to popular and reliable online betting sites, providing users with information on betting platforms, license details, and financial transaction options. It targets Turkish-speaking users interested in sports betting and gambling, operating primarily as an affiliate or informational portal rather than a direct betting service. The website content is basic and focused on gambling-related topics, which require mature audience consideration. From a technical perspective, the site uses basic HTML and CSS with Cloudflare DNS services and is registered through GoDaddy.com, LLC. There is no evidence of advanced frameworks, CMS platforms, or analytics tools. Mobile optimization and accessibility are basic, and SEO practices are minimal. The website lacks privacy, cookie, and terms of service policies, which are critical for compliance and user trust. Security posture is limited; no security headers were detected, and DNSSEC is not enabled, although the domain is protected by registrar-level client prohibitions. No forms or data collection mechanisms were found, reducing the attack surface but also limiting user engagement features. The absence of contact information and incident response channels reduces transparency and trustworthiness. Overall, the website presents moderate risk primarily due to compliance gaps and limited security best practices. Strategic improvements in privacy policy publication, security header implementation, and contact transparency are recommended to enhance trust and compliance.

A

ATKHosting

huatki.com

48

ATKHosting is a Turkish technology service provider specializing in web hosting, software development, web design, server management, and corporate consultancy. Established since 1998, the company targets both individual and corporate clients primarily in Turkey, offering a broad range of IT solutions including Unix and Windows hosting, VPS, dedicated servers, and network solutions. The website presents a professional image with detailed service descriptions and client logos, indicating a stable market presence in the local technology sector. Technically, the website employs a modern front-end stack including Bootstrap, jQuery, and animation libraries, ensuring good mobile optimization and user experience. However, there is no evidence of a CMS or advanced backend frameworks from the HTML content. Performance is moderate, and SEO practices appear adequate with proper meta tags and structured navigation. From a security perspective, the site lacks visible security headers and cookie consent mechanisms, and WHOIS data for the domain is missing or inaccessible, which raises concerns about domain registration transparency. No forms collecting sensitive data are present on the homepage, reducing immediate risk exposure. Overall, the security posture is average with room for improvement in SSL configuration, security headers, and privacy compliance. The overall risk assessment suggests the business is legitimate and professional but should improve domain registration transparency and implement stronger security and privacy controls to enhance trust and compliance.

Yako is a medium-sized Turkish leather and fur garment manufacturer established in 1974 with a long-standing online presence since 1997. The company exports internationally and targets consumers and wholesale buyers interested in leather and shearling products. The website provides basic product showcases, company information, and contact details but lacks modern privacy and security features. Technically, the site uses older JavaScript libraries and lacks visible HTTPS enforcement and security headers, which poses potential risks. The absence of privacy and cookie policies indicates low privacy compliance. Overall, the site is functional but outdated in design and security, requiring improvements to meet modern standards.

O

ODTU Gelistirme Vakfi Bilgi Teknolojileri Sanayi Ve Ticaret Anonim Sirketi

atudutyfree.com

57

Atu Duty Free operates as an e-commerce retail platform specializing in duty free products for travelers, particularly those arriving at Ankara Airport in Turkey. The website offers a range of product categories including fragrances, skincare, make-up, fashion accessories, toys, chocolates, and fine foods, facilitating online ordering with in-store collection and payment. The business is positioned as a niche player in the travel retail sector with a medium-sized operation founded in 2008. Technically, the website employs modern frontend technologies such as Bootstrap, Owl Carousel, and Google Fonts, hosted on Microsoft Azure DNS infrastructure. The site is mobile optimized and provides a good user experience with clear navigation and product categorization. However, some SEO and accessibility features are basic, and performance is moderate. From a security perspective, the site uses HTTPS and integrates Google reCAPTCHA for form protection, but lacks DNSSEC and important security headers. There is no visible privacy or cookie policy, nor explicit contact information for security or data protection matters. These gaps reduce the overall security posture and privacy compliance. Overall, the website is functional and credible but would benefit from enhanced security measures, published privacy and cookie policies, and clearer contact information to improve trust and compliance.

T

TAV Airports

tavairports.com

71

TAV Airports is a global airport operator managing a portfolio of 15 airports across eight countries and three continents, serving millions of passengers annually. The company positions itself as a leader in airport operations with a strong focus on sustainability and service quality. The website reflects a mature enterprise with comprehensive business information, investor relations, and sustainability initiatives. Technically, the website employs modern frameworks such as Bootstrap and Slick Carousel, hosted on Amazon AWS infrastructure, and integrates Google Analytics for traffic monitoring. Accessibility is enhanced through a third-party widget, demonstrating commitment to inclusivity. Security posture is solid with HTTPS enabled and domain transfer protections in place, though improvements like DNSSEC and explicit security policies could enhance trust further. Privacy compliance is partially addressed with cookie consent but lacks a visible privacy policy or terms of service. Overall, the site is professional, trustworthy, and well-aligned with the company's business stature.

E

Ekol Logistics 4.0

ekol.com

70

Ekol Logistics is a well-established integrated logistics company founded in 1990, offering contract logistics, national distribution, foreign trade, and supply chain management services primarily in Turkey. The website reflects a mature digital presence built on WordPress with modern plugins and multimedia content, indicating a moderate to high level of digital maturity. Security posture is generally good with HTTPS enforced and GDPR cookie compliance implemented, though explicit privacy policies and security incident response information are absent. The lack of WHOIS data for the domain introduces some uncertainty regarding domain registration transparency, but the professional website and consistent branding support legitimacy. Overall, the site is functional, professional, and trustworthy with room for improvement in compliance documentation and contact transparency.

H

Hi Bro

hibro.co

64

Hi Bro is a Turkish digital marketing and creative agency specializing in web design, SEO, social media management, PPC advertising, and production services. The company targets businesses primarily in Kocaeli, Kıbrıs, İstanbul, and Ankara, offering tailored digital solutions with over 15 years of experience. Their website demonstrates a professional design with modern technologies and interactive content, reflecting a mature digital presence. The technical infrastructure includes Bootstrap, jQuery, Google Tag Manager, Facebook Pixel, and Cloudflare DNS, supporting a moderate performance and good mobile optimization. Security posture is adequate with HTTPS and reCAPTCHA usage, but lacks advanced security headers and published security policies. Privacy compliance is weak due to absence of privacy and cookie policies. WHOIS data shows domain privacy protection typical for agencies, with domain age consistent with business claims. Overall, the website is functional, professional, and credible but could improve privacy transparency and security practices.

H

Havaş

havas.net

64

Havaş is a well-established Turkish transportation and ground services company, founded in 1999, specializing in airport ground handling, bus services, and cargo warehousing. The website reflects a professional and modern digital presence with a focus on service offerings relevant to airlines, airports, and passengers. The technical infrastructure leverages popular front-end frameworks like Bootstrap and integrates multiple analytics tools such as Google Analytics and Yandex Metrika, indicating a moderate level of digital maturity. Security posture is adequate with HTTPS enabled and domain transfer protections in place, but lacks advanced DNS security (DNSSEC) and security headers, which are recommended for enhanced protection. Privacy compliance is weak due to the absence of visible privacy and cookie policies or consent mechanisms, which could pose regulatory risks. Overall, the website is functional and credible but would benefit from improvements in privacy transparency and security hardening.

B

Baklavacı Güllüoğlu

gulluoglu.com

61

Baklavacı Güllüoğlu operates a well-established e-commerce website specializing in traditional Turkish desserts such as baklava, kadayıf, lokum, and chocolates. The company targets consumers interested in authentic Turkish sweets and offers a variety of products with online ordering and delivery options. The website demonstrates a good level of digital maturity with modern technologies including jQuery, Google Tag Manager, Facebook Pixel, and Google Analytics integrated for marketing and analytics purposes. The site is built on the Hipotenus e-commerce platform, indicating a professional infrastructure. Security posture is strong with HTTPS enforced and cookie consent mechanisms in place, although some HTTP security headers are not explicitly detected. Privacy compliance is robust, with a comprehensive privacy policy and cookie consent banner supporting GDPR requirements. However, the absence of WHOIS data for the domain raises concerns about domain registration transparency, which slightly impacts overall trustworthiness. No evidence of WAF or blocking mechanisms was found, allowing full content accessibility and analysis.

I

INTATI TOUR

iati.com

58

IATI is a well-established online travel platform primarily serving the Turkish market and selected international countries. Founded in 2003, it positions itself as Turkey's largest online travel platform, offering travel booking services and technology solutions. The website is professionally designed with consistent branding and clear navigation, targeting travelers and tourism industry stakeholders. The technical infrastructure leverages common web technologies such as jQuery, Bootstrap, and Google Tag Manager, hosted likely on AWS infrastructure. While the website uses HTTPS and has a long-standing domain, it lacks some advanced security features such as DNSSEC and security headers. Privacy compliance is partial, with a privacy policy and terms of service present but no cookie consent mechanism. Contact information is limited on the main page, which may impact user trust. Overall, the site demonstrates moderate digital maturity with room for security and privacy improvements.

S

SEOPix

seopix.net

57

SEOPix is a Turkish digital marketing agency specializing in conversion-focused services including SEO, Google Ads consultancy, content marketing, web design, and social media management. The company targets businesses in Turkey seeking to enhance their digital presence and customer acquisition through professional marketing strategies. The website demonstrates a mature digital infrastructure with modern technologies such as Bootstrap, jQuery, Owl Carousel, Swiper, Google reCAPTCHA, Google Tag Manager, and Facebook Pixel, indicating a high level of digital maturity and marketing sophistication. Security measures include HTTPS enforcement and CAPTCHA integration on forms, though the absence of security headers and explicit cookie consent mechanisms suggests room for improvement. The WHOIS data is missing or inaccessible, which raises some concerns about domain registration transparency, but the website's professional content and client case studies support its legitimacy. Overall, SEOPix presents a strong market position in the Turkish digital marketing sector with a well-optimized and user-friendly website.

D

DATA HİDROLİK MAKİNA SANAYİ A.Ş.

datahidrolik.com

47

DATA Hidrolik Makina Sanayi A.Ş. is a Turkish company specializing in the design and manufacturing of hydraulic steering systems and deck machinery for maritime vessels since 1945. The company positions itself as a respected and established brand in the marine hydraulic equipment sector, serving a professional maritime audience with a focus on quality and innovation. Their website reflects a professional digital presence with clear product categories, corporate information, and multimedia content to engage visitors. Technically, the website uses modern frameworks such as Bootstrap and jQuery, integrates Google Tag Manager and Facebook Pixel for analytics and marketing, and is mobile optimized with good SEO practices. Security-wise, the site enforces HTTPS and includes CSRF tokens and cookie consent mechanisms, but lacks advanced security headers and published security policies. The absence of WHOIS registration data is a notable concern, impacting domain legitimacy trust. Overall, the website is functional, professional, and compliant with basic privacy regulations, but would benefit from enhanced security transparency and domain registration verification.

Aksa Akrilik Kimya Sanayii is a leading manufacturer specializing in acrylic fibers, holding the position as the world's largest and Turkey's sole producer in this sector. Established in 1971, the company has a strong market presence supported by numerous certifications and awards, reflecting its commitment to quality and sustainability. The website targets industry professionals, investors, and potential employees, providing comprehensive corporate, sustainability, and investor relations information. Technically, the website employs a modern tech stack including Bootstrap, jQuery, and FontAwesome, hosted on Microsoft Azure DNS infrastructure. The site is mobile-optimized with good navigation and content quality, although some accessibility features are basic. Analytics tools such as Google Analytics and Google Tag Manager are used for user tracking at a moderate level. From a security perspective, the site uses HTTPS and domain locking mechanisms but lacks explicit security headers and a cookie consent mechanism, which are areas for improvement. No critical vulnerabilities or blocking mechanisms were detected, indicating a generally secure posture. Overall, the website is professional and trustworthy, with a well-established domain and consistent WHOIS data. Strategic recommendations include enhancing privacy compliance with cookie consent, implementing security headers, and publishing incident response and vulnerability disclosure policies to strengthen security and compliance posture.

S

SUNSEEKER TURKEY

sunseekerturkey.com

69

Sunseeker Turkey represents a luxury motor yacht brand targeting affluent customers interested in high-end marine vessels. The website showcases the brand's commitment to design and engineering excellence, positioning itself as a leading distributor in Turkey. The technical infrastructure is modern, leveraging React and Next.js frameworks, with integration of Google Tag Manager and OneTrust for analytics and cookie consent respectively. The site is mobile optimized and provides a professional user experience with clear navigation and branding consistency. However, the absence of WHOIS registration data raises concerns about domain legitimacy, which impacts overall trustworthiness. Security posture is adequate with HTTPS enforced but lacks comprehensive security headers and explicit security policies. Privacy compliance is partial, with cookie consent present but no visible privacy or terms of service pages. Contact information is available primarily via phone and social media channels, but no verified company emails were found. Overall, the website is functional and professional but requires improvements in domain legitimacy verification, privacy policy transparency, and security best practices to enhance trust and compliance.

B

Bahçeşehir Üniversitesi

applybau.com

53

ApplyBAU is an educational platform operated by Bahçeşehir University, providing a unique university admission and scholarship system that considers personal talents and projects beyond traditional exam scores. The platform targets prospective students in Turkey and has been operational since 2013, positioning itself as a pioneering admission model in the region. The website is professionally designed, mobile optimized, and integrates multiple social media channels and video content to engage its audience. Technically, the site uses a modern tech stack including Bootstrap, jQuery, and various analytics and marketing tools such as Google Analytics, Facebook Pixel, TikTok Pixel, Hotjar, and Microsoft Clarity. Hosting and DNS are managed via Cloudflare, enhancing performance and security. Security posture is adequate with HTTPS enforced and domain transfer protections, but lacks visible security headers and explicit privacy or cookie policies, which are critical for compliance and user trust. The WHOIS data confirms domain legitimacy and consistency with the business history. Overall, the site is functional and credible but would benefit from enhanced privacy compliance and security best practices.

B

Bahçeşehir Üniversitesi Kuluçka Merkezi

bau-hub.com

57

BAU Hub is a technology startup incubation center affiliated with Bahçeşehir University, established in 2021. It focuses on accelerating early-stage and fast-growing startups primarily in the gaming, education, and deep technology sectors. The center offers tailored incubation programs, mentorship, office infrastructure, and access to funding and business networks. The website is professionally designed using WordPress and Elementor, with a moderate performance profile and good mobile optimization. Security posture is adequate with HTTPS and Cloudflare DNS but lacks advanced security headers and published security policies. Privacy compliance is weak due to missing privacy and cookie policies. Contact information is comprehensive, including email, physical addresses, and contact forms. The domain registration is transparent and consistent with the business identity, enhancing trustworthiness.

B

BAU Global

bauglobal.com

63

BAU Global is a well-established international education network founded in 2014, offering a broad range of academic programs through its universities, liaison offices, language schools, and K12 institutions. The website reflects a mature digital presence with a clear focus on education and cultural exchange, targeting students and academic professionals worldwide. Technically, the site leverages WordPress CMS with modern JavaScript libraries and integrates Google Analytics for user insights. Security posture is adequate with HTTPS and some security headers, though improvements such as DNSSEC and CSP are recommended. Privacy compliance is addressed with visible policies and consent mechanisms. Overall, the site demonstrates a strong business credibility and trustworthy domain registration, supporting its position in the education sector.

A

Alantron Bilisim Ltd.

alantron.com

61

Alantron Bilisim Ltd. is a well-established Turkish technology company specializing in domain registration, web hosting, VPS, dedicated servers, email hosting, and SSL certificate services. Founded in 2003, it holds the distinction of being Turkey's first ICANN accredited domain registrar, positioning itself as a trusted local provider with over 20 years of industry experience. The company targets businesses and individuals in Turkey seeking comprehensive internet infrastructure services. Technically, the website employs modern web technologies including Bootstrap, jQuery, and GSAP for animations, offering a responsive and user-friendly experience. However, some technical improvements could enhance performance and security. Security posture is moderate; while HTTPS is implied and basic form security is implemented, the absence of key security headers and anti-CSRF protections suggests room for improvement. Privacy compliance is weak, with no visible privacy or cookie policies, which could pose regulatory risks. Overall, the domain registration details align well with the company's claims, reinforcing legitimacy and trustworthiness.

İGA İstanbul Havalimanı operates one of the world's largest and busiest airports, providing comprehensive airport management, cargo logistics, commercial leasing, and career development services. The website reflects a mature enterprise with a strong market position in the transportation sector, targeting passengers, business partners, and job seekers. Technically, the site uses modern web technologies including Google Tag Manager, YouTube API, and cookie consent tools, delivering a responsive and well-structured user experience. Security posture is strong with HTTPS enforced and cookie consent mechanisms in place, though some security headers could be improved. No critical vulnerabilities or exposed sensitive data were found. Overall, the site demonstrates high professionalism, trustworthiness, and compliance with privacy regulations, though explicit terms of service and security policy pages are absent.

Bahçeşehir Üniversitesi is a prominent private higher education institution based in Turkey, offering a wide range of undergraduate and graduate programs, research centers, and international academic collaborations. The university positions itself as a global university with campuses and partnerships across multiple countries. The website reflects a mature digital presence with a professional design, clear navigation, and mobile optimization, supporting a large and diverse audience including students, academics, and international stakeholders. Technically, the site employs modern frameworks such as Bootstrap and integrates advanced analytics and tracking tools like Google Analytics and Facebook Pixel, indicating a data-driven approach to user engagement and marketing. Security posture is strong with HTTPS enforcement and standard security practices, although there is room for improvement in publicly disclosing privacy and cookie policies as well as security policies. Overall, the domain registration and WHOIS data align well with the university's claims, supporting its legitimacy and trustworthiness.

Akbank T.A.Ş. is a leading Turkish bank offering a wide range of financial services including retail and corporate banking, digital banking, loans, investments, insurance, and payment services. The website is professionally designed, mobile-optimized, and provides comprehensive content and interactive tools such as loan calculators and market data. Technically, the site is built on Microsoft SharePoint with modern JavaScript libraries and integrates analytics and marketing tools like Google Analytics, Google Tag Manager, Adjust, and Dataroid. Security posture is strong with HTTPS enforced, secure forms, and no visible vulnerabilities, although explicit security policies and incident response contacts are not found. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. WHOIS data confirms the legitimacy and consistency of the domain with the business entity. Overall, the site demonstrates a mature digital presence with high trustworthiness and professionalism.

T

Turistik Hava Taşımacılık A.Ş.

corendon-airlines.com

58

Corendon Airlines is a well-established Turkish airline founded in 2004, providing affordable flight tickets and holiday services primarily targeting leisure travelers in Europe and Turkey. The company holds multiple industry certifications including IATA and IOSA, reflecting a strong market position and commitment to quality and safety. Their website offers comprehensive services including flight booking, online check-in, additional services like baggage and seat selection, group bookings, and partnerships for car hire and hotels. The digital infrastructure is modern, utilizing popular JavaScript libraries and marketing tools, with good mobile optimization and user experience. Security measures include HTTPS, reCAPTCHA, and use of security-conscious script loading, though additional security headers could enhance protection. The site is fully accessible without WAF or blocking mechanisms, indicating reliable availability. Overall, the website and business demonstrate high professionalism, trustworthiness, and compliance with privacy regulations.

S

Sermaye Piyasası Kurulu

spk.gov.tr

40

Sermaye Piyasası Kurulu (SPK) is the official Capital Markets Board of Turkey, serving as the primary regulatory authority overseeing capital markets, investment firms, and financial instruments within the country. The website provides comprehensive information and services targeted at investors, companies, and financial institutions, including regulatory frameworks, bulletins, licensing exams, and investor education. The site is well-branded, consistent, and professionally maintained, reflecting its authoritative government status. Technically, the website employs modern web technologies such as HTML5, CSS3, JavaScript libraries including Swiper.js for carousels and Tobii.js for lightbox functionality, and integrates Google Fonts and Google Tag Manager for analytics. The site is mobile-optimized with good navigation and SEO practices, although accessibility features could be enhanced. From a security perspective, the site enforces HTTPS with an excellent SSL configuration and follows best practices like opening external links in new tabs and avoiding exposed sensitive data. However, it lacks explicit security policies, incident response contacts, and a cookie consent mechanism, which are areas for improvement to enhance compliance and user trust. Overall, the website is a credible and authoritative source for capital market regulation in Turkey, with a strong business credibility score and good technical implementation. Strategic recommendations include adding privacy and security policy pages, implementing cookie consent, and enhancing accessibility and security headers to further strengthen the site's security posture and compliance.

E

EEistanbul

ee-istanbul.com

45

EE Istanbul is a medium-sized company specializing in project management, design, and consultancy services within the construction and real estate sectors. Their portfolio includes office buildings, retail stores, industrial facilities, and renovation projects primarily in Turkey. The website showcases a variety of completed projects and notable clients, indicating a solid market presence. Technically, the website uses a traditional tech stack including jQuery, Bootstrap, and ASP.NET MVC, with moderate performance and good mobile optimization. However, the absence of HTTPS and security headers significantly weakens the security posture. Privacy compliance is minimal, with no visible privacy or cookie policies. Overall, the website is functional and professional but requires urgent security and compliance improvements.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 11 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

E

Eti

etietieti.com

39

Eti is a well-established Turkish food manufacturing company with a strong market presence and a diverse product portfolio including biscuits, chocolates, and health-oriented food products. The website serves as a comprehensive corporate portal providing product information, recipes, corporate governance details, career opportunities, and social responsibility initiatives. The site targets consumers interested in quality food products and healthy nutrition, leveraging a consistent brand identity and multiple language options for international reach. Technically, the website is built on ASP.NET WebForms and uses modern JavaScript libraries for UI enhancements. However, performance metrics are lacking and the site suffers from a critical security issue: the absence of a valid SSL certificate and HTTPS support, which significantly impacts user trust and security posture. Privacy and cookie policies are well implemented with consent mechanisms, reflecting good compliance with GDPR requirements. Social media integration and partner links enhance the brand's digital ecosystem. Overall, Eti's website is professional and content-rich but requires urgent security improvements to meet modern standards.

The website atlas.net.tr is currently inaccessible due to a Cloudflare Web Application Firewall (WAF) challenge page, which blocks direct access to the site's content. This prevents a full assessment of the business, its services, and compliance posture. The domain is registered in Turkey and uses Cloudflare for DNS and protection, but lacks a valid SSL certificate and HTTPS support, which is a critical security deficiency. No privacy, cookie, or terms of service policies are detectable, and no contact information is available on the landing page. The technical infrastructure relies on Cloudflare, but the absence of modern TLS protocols and security best practices reduces the security posture significantly. Overall, the site exhibits minimal content and poor user experience due to the blocking mechanism.

D

DenizBank A.Ş.

denizbank.com

40

DenizBank A.Ş. is a large Turkish financial institution offering a broad range of banking services including retail, corporate, and specialized banking sectors. The website reflects a mature digital presence with comprehensive service offerings, detailed legal disclosures, and strong branding consistency. The bank targets both individual and business customers with tailored products and digital banking solutions. The site includes rich content, interactive calculators, and marketing campaigns, indicating a well-developed digital marketing strategy. Technically, the website uses modern JavaScript frameworks and integrates third-party marketing and analytics tools such as Google Tag Manager and Adjust. However, performance metrics indicate slow loading times, and the SSL/TLS configuration is critically flawed with an invalid certificate and no TLS protocols enabled, posing significant security risks. Security posture is moderate with good use of security headers but undermined by the lack of valid SSL and TLS support. Privacy compliance is strong with detailed privacy policies and data protection disclosures, including a dedicated KVKK (Turkish data protection law) section. Contact information is clearly presented, enhancing business credibility. Overall, while the business and content aspects are strong, the critical SSL issues represent a major risk that must be addressed immediately to protect user data and maintain trust.

The website represents the Türkiye-EU Business Dialogue II (TEBD II), an EU-funded project implemented by Eurochambres to foster cooperation between Turkish and European chambers of commerce. The project focuses on capacity building, business dialogues, and grant schemes to support integration and awareness of Türkiye's potential EU accession. The website is currently under maintenance, providing visitors with contact information and social media links for updates. Technically, the site uses modern frontend technologies such as Tailwind CSS and Lucide icons but suffers from slow load times and lacks a valid SSL certificate, resulting in insecure HTTP access. Security posture is weak due to the absence of HTTPS, security headers, and modern TLS protocols. No privacy or cookie policies are present, indicating poor privacy compliance. Business credibility is moderate, supported by official EU funding logos and a professional maintenance notice. Overall, the site requires urgent security improvements and policy implementations to enhance trust and compliance.

T

Tur Assist

turassist.com

47

The website's overall security posture is critically weak, with multiple severe vulnerabilities primarily due to the absence of HTTPS encryption and inadequate security headers. The lack of HTTPS not only exposes sensitive data in transit but also results in non-compliance with GDPR and NIS2 regulations, posing significant legal and reputational risks. Key security headers such as Content-Security-Policy and X-Frame-Options are missing, increasing susceptibility to cross-site scripting and clickjacking attacks. Additionally, the absence of a privacy policy, cookie policy, and consent mechanisms indicates poor GDPR adherence, further risking regulatory penalties. The organization lacks foundational information security documentation, incident response procedures, and business continuity planning, undermining its ability to effectively manage and recover from security incidents. While email and network security appear strong, these do not compensate for the critical gaps in web and data protection. Immediate remediation is essential to protect customer data, maintain trust, and ensure compliance with legal frameworks. Overall, the current security posture exposes the business to high risk of data breaches, regulatory fines, and operational disruptions.