Transportation security reports

Κ

ΚΕΡΚΥΡΑΙΚΗ ΝΑΥΑΓΟΣΩΣΤΙΚΗ MON.IKE

rent4allcorfu.com

72

Rent4All Corfu is a small transportation and hospitality business specializing in car and scooter rentals on the Greek island of Corfu. The company emphasizes transparency, customer service, and convenience, offering airport pick-up and island-wide delivery. Their website is well-structured, mobile-optimized, and integrates modern web technologies including Livewire and service workers, supporting a progressive web app experience. The site includes comprehensive privacy and cookie policies aligned with GDPR requirements, and actively uses analytics and advertising tools such as Google Analytics and Facebook Pixel with user consent mechanisms. Security posture is generally strong with HTTPS and CSRF protections, though explicit security headers are missing. The absence of WHOIS registration data is a notable concern but does not align with the professional and trustworthy appearance of the site and business. Overall, the website presents a credible and user-friendly platform for vehicle rentals in Corfu.

L

LIPEX PLUS spol. s.r.o.

citroencl.cz

45

LIPEX PLUS spol. s.r.o. operates the website citroencl.cz as a specialized Citroën dealership and service center located in Česká Lípa, Czech Republic. The company offers automotive sales, servicing, emission testing, and financing services primarily targeting Citroën vehicle owners in the local region. The website presents a professional and consistent brand image with clear contact details and social media presence, supporting its local market position. Technically, the website uses a traditional tech stack including jQuery, Bootstrap, and Google Analytics, with a responsive but basic mobile optimization. The site is moderately performant with clear navigation and SEO basics in place. However, there is no evidence of advanced CMS or modern frameworks, and accessibility features are minimal. From a security perspective, the site lacks visible security headers and does not provide privacy or cookie policies, indicating gaps in GDPR compliance and security best practices. No incident response or vulnerability disclosure information is present. The domain registration data is consistent and supports the legitimacy of the business. No WAF or blocking mechanisms were detected, and the site content is safe for general audiences. Overall, the website is functional and credible for its business purpose but would benefit from enhanced security measures, privacy compliance improvements, and modern technical upgrades to strengthen trust and regulatory adherence.

L

LIPEX PLUS spol. s r.o.

hondacl.cz

43

Honda Česká Lípa, operated by LIPEX PLUS spol. s r.o., is a small-sized authorized dealer and service provider specializing in Honda vehicles and garden machinery in the Czech Republic. The company offers a comprehensive range of automotive services including sales of new and used cars, authorized repairs, tire services, emission testing, and garden equipment sales. The website reflects a professional and consistent brand image with clear contact information and customer testimonials, positioning the company as a trusted local business with over 20 years of experience. Technically, the website employs modern frontend technologies such as Bootstrap, jQuery, and Google Analytics, ensuring a responsive and user-friendly experience. However, the absence of detected security headers and privacy policies indicates room for improvement in security and compliance. The site is accessible without any WAF or blocking mechanisms, but the lack of WHOIS data reduces domain trustworthiness and raises questions about domain registration transparency. From a security perspective, the site shows no immediate vulnerabilities or exposed sensitive data, but the missing privacy and cookie policies and lack of incident response information highlight compliance gaps, particularly with GDPR. The use of Google Analytics suggests moderate user tracking, but without clear privacy disclosures. Overall, the security posture is moderate but could be enhanced with standard best practices. Strategically, the company should prioritize establishing clear privacy and cookie policies, implement security headers, and verify domain registration details to improve trust and compliance. Enhancing incident response readiness and communicating data protection officer contacts would further strengthen their security culture and customer confidence.

F

F1 Experiences

f1experiences.com

72

F1 Experiences operates as the official provider of Formula 1 race tickets, hospitality, and travel packages worldwide. The company holds a strong market position as the exclusive source for premium F1 experiences, targeting motorsport enthusiasts and corporate clients seeking high-end event access. Their website reflects a mature digital presence with multi-language support, comprehensive event calendars, and clear navigation, supporting a global audience. Technically, the site leverages modern JavaScript libraries, integrates secure payment gateways like Stripe, and uses reputable analytics and marketing tools, hosted on AWS with CDN support for performance and scalability. Security posture is robust with HTTPS enforcement, security headers, and domain registration protections, though DNSSEC is not enabled and no explicit security policy or incident response contacts are published. Privacy compliance is addressed with cookie consent mechanisms and a basic privacy policy, indicating GDPR awareness. Overall, the site is professional, trustworthy, and well-optimized for user experience and business operations.

K

KANAL M.P.S. s.r.o.

kanal-mps.sk

43

KANAL M.P.S. s.r.o. is a Slovak company specializing in sewer and drainage system services including electromechanical cleaning, high-pressure cleaning, and TV monitoring of sewer pipes. Established in 2003, it holds a stable market position with a medium-sized operation focused on servicing Slovak businesses and institutions. The website reflects a professional business model with clear service offerings and a consistent brand presence. Technically, the site uses modern JavaScript libraries such as jQuery, Lodash, Swiper.js, and Fancybox, hosted likely on Websupport infrastructure with DNSSEC enabled, ensuring domain security. The site is mobile-optimized and provides a good user experience with clear navigation and relevant content. Security posture is adequate with HTTPS and DNSSEC but lacks advanced security headers and explicit incident response or vulnerability disclosure policies. Privacy compliance is partial, with a cookie consent mechanism but no dedicated privacy policy or terms of service pages. Overall, the site is trustworthy and safe, with no adult or questionable content detected.

F

Formula 1®

formula1.com

69

Formula 1's official website serves as the primary digital platform for global fans and stakeholders of the Formula 1 racing series. It offers comprehensive content including news, race schedules, results, driver and team profiles, video highlights, and ticketing services. The site also supports subscription-based streaming via F1 TV, enhancing fan engagement with live and on-demand content. The platform is well-positioned as the authoritative source for Formula 1 information and entertainment, leveraging strong branding and partnerships with official entities such as the FIA. Technically, the website employs a modern technology stack including React with Next.js for server-side rendering, Brightcove for video delivery, and Cloudinary for media management. It integrates various analytics and monitoring tools such as Google Analytics and New Relic, and implements a consent management platform to comply with privacy regulations. The site is optimized for performance, mobile responsiveness, and accessibility, providing a seamless user experience across devices. From a security perspective, the website enforces HTTPS, utilizes robust security headers, and manages user consent effectively. However, there is no publicly available security policy or incident response contact information, and no vulnerability disclosure program is evident. The WHOIS data for the domain is unavailable, likely due to privacy or registry restrictions, but the website's official nature and consistent branding mitigate concerns about legitimacy. Overall, the website demonstrates a high level of professionalism, security, and compliance suitable for a major international sports brand. Strategic recommendations include publishing explicit security policies, establishing a vulnerability disclosure channel, and enhancing transparency around incident response to further strengthen trust and security posture.

F

fireTMS.com Sp. z o.o.

firetms.com

76

fireTMS.com Sp. z o.o. operates a mature and well-established transport management system platform targeting carriers and forwarders globally, with a strong presence in Poland and Europe. The company offers a comprehensive SaaS solution integrating transport planning, order management, invoicing, GPS tracking, and mobile applications, supported by a freight exchange service (fireXgo). The business is part of the Eurowag Group, enhancing its market credibility and reach. Technically, the website is built on modern frameworks like Next.js and React, optimized for performance and mobile responsiveness, and integrates multiple marketing and analytics tools. Security posture is solid with HTTPS, reCAPTCHA, and cookie consent mechanisms, though explicit security policies and vulnerability disclosure mechanisms are absent. Overall, the website and business demonstrate high professionalism, trustworthiness, and compliance with GDPR, making fireTMS a credible and competitive player in the transport software industry.

W

W.A.G. payment solutions, a.s.

cvs-mobile.com

52

W.A.G. payment solutions, a.s., operating under the Eurowag brand, is a leading European provider of integrated mobility and payment solutions focused on the transportation sector. The company offers a comprehensive suite of services including fleet management telematics, fuel cards, toll payment solutions, tax refund services, and eMobility options. Their recent integration of CVS Mobile enhances their fleet management capabilities with advanced real-time tracking and route planning, positioning them strongly in the European transport market. The website reflects a mature digital presence with multi-language support and country-specific offerings, targeting fleet operators and logistics managers across Europe. Technically, the website is built on the Webflow platform, leveraging modern web technologies such as Google Tag Manager for analytics and tracking, and intl-tel-input for phone input handling. The site is well-optimized for mobile devices, accessible, and fast-loading, demonstrating a high level of digital maturity. The presence of comprehensive legal, privacy, and cookie policies indicates a strong commitment to compliance and user privacy. From a security perspective, the site enforces HTTPS and implements cookie consent mechanisms, though explicit security headers are not detected in the provided data. No vulnerabilities or exposed sensitive data were found in the content. The absence of WHOIS data limits domain registration trust analysis, but the website's professional presentation, regulatory disclosures, and trust signals support a strong security posture. Overall, the website presents a low-risk profile with robust business credibility and technical implementation. Strategic recommendations include enhancing security headers, publishing an incident response page, and adding a vulnerability disclosure policy to further strengthen security transparency and resilience.

W

W.A.G. payment solutions, a.s.

gbox.pl

65

W.A.G. payment solutions, a.s. operates as a leading European provider of integrated mobility and payment solutions, primarily serving the transportation and fleet management sectors. Their website promotes the GBox telematics platform, offering real-time vehicle tracking, driver monitoring, and data analytics to optimize fleet operations and reduce costs. The company targets transport companies, fleet managers, and logistics operators with a comprehensive suite of telematics and payment services, supported by multiple digital portals and mobile applications. Technically, the website is built on the Webflow CMS platform, leveraging modern JavaScript libraries such as jQuery and intl-tel-input, and integrates Google Tag Manager and LiveChat for analytics and customer support. The site is well-optimized for mobile devices, accessibility, and SEO, with a fast loading performance and structured navigation. Privacy and cookie policies are clearly presented with consent mechanisms, reflecting good compliance with GDPR requirements. From a security perspective, the site enforces HTTPS, uses CAPTCHA on forms, and avoids exposing sensitive data. However, explicit security headers like CSP and HSTS are not detected, and no public vulnerability disclosure or incident response contacts are provided. The WHOIS data is unavailable publicly, which slightly reduces transparency but is common for corporate domains. Overall, the security posture is solid but could be enhanced with additional headers and disclosure practices. The overall risk assessment indicates a trustworthy and professional online presence with moderate to high credibility. Strategic recommendations include improving security header implementation, publishing a security.txt file, and enhancing incident response transparency to further strengthen trust and compliance.

W

W.A.G. payment solutions, a.s.

ocrk.pl

63

W.A.G. payment solutions, a.s. operates a professional website focused on providing integrated mobility and payment solutions for the European transport sector. The site highlights expert services in driver work time management, compliance, and financial settlements, targeting transport companies and fleet managers. The company positions itself as a leading provider with a broad portfolio including fuel cards, toll services, telematics, and financial services. The website is well-structured, multilingual, and rich in content, reflecting a mature digital presence. Technically, the site leverages modern web technologies including Webflow CMS, JavaScript libraries like jQuery and intl-tel-input, and integrates Google Tag Manager and LiveChat for analytics and customer support. The site is mobile-optimized and accessible, with cookie consent mechanisms and GDPR-compliant privacy policies. Security measures include HTTPS and CAPTCHA on forms, though explicit security headers and incident response information are not evident. The security posture is solid but could be improved by adding security headers and publishing vulnerability disclosure information. The absence of WHOIS data reduces trust slightly but the professional presentation and consistent business information mitigate concerns. Overall, the site demonstrates a strong business and technical foundation with room for enhanced security transparency. Strategic recommendations include implementing security headers, publishing a security.txt file, providing incident response contacts, and improving WHOIS transparency to enhance trust and compliance.

W

W.A.G. payment solutions, a.s.

webeye.eu

64

W.A.G. payment solutions, a.s., operating under the brand Eurowag, is a leading provider of integrated mobility and payment solutions tailored for the European transportation sector. The company offers a comprehensive suite of services including fleet management, toll payment solutions, fuel cards, tax refunds, and financial services, targeting commercial fleet operators and logistics companies. Their market position is strong, supported by a large-scale operation and a broad geographic presence across multiple European countries. Technically, the website is built on modern web technologies including Webflow CMS, jQuery, and Google Tag Manager, hosted on a performant CDN infrastructure. The site is well-optimized for mobile devices, accessibility, and SEO, reflecting a mature digital presence. The integration of multiple login portals and partner platforms indicates a complex and well-managed technical ecosystem. From a security perspective, the website enforces HTTPS and implements cookie consent mechanisms, demonstrating compliance with privacy regulations such as GDPR. However, explicit security headers are not visibly configured, and there is no public incident response or vulnerability disclosure policy, which are areas for improvement. No critical vulnerabilities or exposed sensitive data were detected. Overall, the website presents a professional and trustworthy front for a large enterprise in the transportation and payment services industry. The lack of WHOIS data reduces transparency but does not detract significantly from the site's legitimacy. Strategic recommendations include enhancing security headers, publishing incident response contacts, and formalizing vulnerability disclosure policies to strengthen trust and compliance.

N

Nahverkehrsservice Sachsen-Anhalt GmbH

insa.de

57

Nahverkehrsservice Sachsen-Anhalt GmbH operates the INSA platform, a regional public transportation service providing comprehensive timetable information and ticketing solutions for Sachsen-Anhalt and the Mitteldeutschen Verkehrsverbund (MDV). The website serves as a digital hub for users seeking mobility information, ticket purchases, and related services such as the INSA app and RufBus ordering. Positioned as a key regional mobility facilitator, INSA leverages modern web technologies and complies with GDPR regulations to ensure user privacy and data protection. Technically, the website is built on TYPO3 CMS, integrating JavaScript libraries such as ReadSpeaker for accessibility and Cookiebot for consent management. The infrastructure is hosted with professional DNS providers and employs HTTPS with good SSL configuration, ensuring secure communications. The site demonstrates good mobile optimization, accessibility, and SEO practices, providing a user-friendly experience. From a security perspective, the site enforces HTTPS, uses cookie consent mechanisms, and avoids exposing sensitive data. However, it lacks explicit published security policies or incident response contacts, which could be improved to enhance trust and readiness. Analytics usage is moderate with Piwik (Matomo), respecting privacy with clear retention policies. Overall, the website is trustworthy, professionally maintained, and compliant with privacy laws. Strategic recommendations include publishing a security.txt file, incident response contacts, and expanding security policy disclosures to strengthen the security posture and user trust.

Pon.Bike is a global group of bicycle brands offering a wide range of bicycles across various market segments, from off-road downhill racing bikes to urban luggage carriers. The website positions itself as a leading player in the bicycle industry with a professional and modern digital presence. The business model focuses on multi-brand management and distribution, targeting consumers and businesses interested in bicycles worldwide. The site content is well-structured, with clear branding and consistent messaging.

Zweckverband Verkehrsverbund Oberlausitz-Niederschlesien (ZVON) operates a regional public transportation portal serving the Oberlausitz and Niederschlesien regions in Germany. The website provides comprehensive information on public transit schedules, ticketing, network maps, and current service updates, targeting local commuters and travelers. The business model centers on facilitating access to public transport services and enhancing user experience through digital tools such as real-time departure monitors and fare calculators. The organization holds a solid regional market position as a trusted mobility service provider.

N

Nahverkehrsservice Sachsen-Anhalt GmbH

nasa.de

64

Nahverkehrsservice Sachsen-Anhalt GmbH (NASA GmbH) is a regional public transportation authority responsible for planning, ordering, and financing local rail passenger transport in the German state of Sachsen-Anhalt. The company also operates the INSA timetable information system, serving public transport users and stakeholders in the region. The website reflects a professional and consistent brand presence, targeting primarily German-speaking users interested in regional mobility services. The business model focuses on public sector transportation planning and service provision, positioning NASA GmbH as an essential regional player in transportation infrastructure and information services. Technically, the website is built on the TYPO3 CMS platform, integrating modern web technologies such as jQuery, ReadSpeaker for accessibility, and Cookiebot for GDPR-compliant cookie management. Hosting is managed via DomainControl nameservers, and the site demonstrates good mobile optimization, accessibility, and SEO practices. Analytics are conducted using Piwik (Matomo), indicating a privacy-conscious approach to user data collection. From a security perspective, the site enforces HTTPS and implements a comprehensive cookie consent mechanism. However, explicit security headers like Content-Security-Policy and X-Frame-Options are not evident, and no public security policy or incident response contacts are published. No vulnerabilities or exposed sensitive data were detected in the analyzed content. The domain registration appears legitimate and consistent with the business's regional focus. Overall, the website presents a low-risk profile with strong privacy compliance and good technical implementation. Strategic improvements could include publishing a formal security policy, adding security headers, and establishing a vulnerability disclosure process to enhance trust and security posture further.

F

Fahrgastforum Sachsen-Anhalt

fahrgastforum.de

64

Fahrgastforum Sachsen-Anhalt operates a regional public transport passenger forum website focused on collecting and sharing ideas, questions, and feedback about regional trains, S-Bahn, and PlusBus services in Sachsen-Anhalt, Germany. The site targets local passengers and community members interested in improving public transport services. It is positioned as a community engagement platform with a clear focus on regional transportation issues. The website uses TYPO3 CMS and Bootstrap for a responsive and accessible user experience, supported by Cookiebot for cookie consent management and Piwik (Matomo) for analytics. The technical infrastructure is modern and adequate for the site's purpose, hosted on domaincontrol.com nameservers.

N

Nahverkehrsservice Sachsen-Anhalt GmbH

mein-takt.de

56

Mein Takt Sachsen-Anhalt is the official regional mobility brand for the German state of Sachsen-Anhalt, operated by Nahverkehrsservice Sachsen-Anhalt GmbH. The website provides comprehensive information and services related to regional trains, S-Bahn, PlusBus lines, train stations, and travel information via the INSA Fahrplanauskunft system. The site targets public transport users within the region and serves as a key information portal for mobility services. Technically, the website is built on TYPO3 CMS, integrates modern JavaScript libraries, and uses Cookiebot for GDPR-compliant cookie consent. The presence of accessibility features and mobile optimization indicates a mature digital infrastructure. Security-wise, the site enforces HTTPS and uses cookie consent mechanisms but lacks explicit security headers and published security policies. Overall, the site is professional, trustworthy, and compliant with privacy regulations, though it could improve transparency around security and incident response.

N

Nahverkehrsservice Sachsen-Anhalt GmbH

starker-nahverkehr.de

56

Mein Takt Sachsen-Anhalt is a regional public transportation brand operated by Nahverkehrsservice Sachsen-Anhalt GmbH, focusing on providing mobility services including regional trains, S-Bahn, PlusBus lines, and travel information via the INSA system. The website serves residents and travelers in the German state of Sachsen-Anhalt, offering comprehensive travel planning tools and service information. The site is built on TYPO3 CMS and integrates third-party services such as Cookiebot for cookie consent and INSA for travel planning. The technical infrastructure is modern and well-implemented, with good mobile optimization and accessibility features. Security posture is solid with HTTPS enforced and cookie consent mechanisms in place, though explicit security headers and incident response policies are not publicly documented. Privacy compliance is strong, with a detailed privacy policy and GDPR-aligned cookie consent. Overall, the website is professional, trustworthy, and serves its target audience effectively.

D

Deutsche Bahn AG

deutschebahn.com

71

Deutsche Bahn AG operates as Germany's leading railway company, offering comprehensive passenger and freight transportation services, infrastructure management, and innovative mobility solutions. The website reflects a mature digital presence with a professional design, clear navigation, and extensive content covering corporate information, sustainability, digitalization, and business units. The company targets a broad audience including customers, investors, and partners, positioning itself as a key player in the European transportation sector. Technically, the site leverages modern technologies such as CoreMedia CMS, Matomo analytics, and Usercentrics for consent management, ensuring compliance with GDPR and providing a good user experience across devices. The security posture is strong with HTTPS enforcement and security headers, although explicit security policies and incident response contacts are not published. Overall, the website is trustworthy and professionally maintained, though the WHOIS data for the queried domain variant is missing, which warrants verification. The site does not exhibit any adult or questionable content and maintains good privacy compliance. Strategic recommendations include publishing detailed security policies, incident response information, and vulnerability disclosure mechanisms to enhance transparency and trust.

D

Deutsche Bahn AG

db-ersatzverkehr.de

61

The website 'Ersatzverkehr bei Generalsanierungen' is an official informational portal operated by Deutsche Bahn AG, focusing on replacement bus services during major rail infrastructure renovations in Germany. It serves travelers and freight customers by providing timely updates, travel alternatives, and detailed information about ongoing and upcoming construction projects. The site leverages a modern technical infrastructure including CoreMedia CMS, Usercentrics for cookie consent, and Matomo for privacy-conscious analytics. The design is professional, mobile-optimized, and accessible, reflecting Deutsche Bahn's strong brand identity and commitment to user experience. Security posture is solid with HTTPS enforced and no exposed sensitive data, though explicit security policies and incident response contacts are not published. Overall, the domain registration and website content are consistent and trustworthy, supporting a high legitimacy score.

V

VMV – Verkehrsgesellschaft Mecklenburg-Vorpommern mbH

vmv-mbh.de

54

VMV – Verkehrsgesellschaft Mecklenburg-Vorpommern mbH operates as a regional public transportation company in Mecklenburg-Vorpommern, Germany, providing services related to public transit schedules, ticketing, and regional transport network management. The website serves as an information portal for residents and travelers, offering schedule information, news updates, and contact options. The company positions itself as a key regional transportation authority with a focus on accessibility and customer engagement. Technically, the website is built on WordPress using modern plugins such as Elementor and Yoast SEO, ensuring good SEO and mobile responsiveness. Security posture is solid with HTTPS enforced and no visible vulnerabilities, though security headers and explicit security policies could be improved. Privacy compliance is evident with a comprehensive privacy and cookie policy, aligned with GDPR requirements. Overall, the website is professional, trustworthy, and well-maintained, supporting the company's regional transportation mission.

V

Verkehrsverbund Bremen/Niedersachsen GmbH

fahrplaner.de

64

The FahrPlaner website serves as the official digital platform for public transportation information and ticketing in the German regions of Niedersachsen and Bremen. Operated by Verkehrsverbund Bremen/Niedersachsen GmbH, it offers real-time timetable data, mobile ticket purchasing, and comprehensive route planning through a well-integrated app and web interface. The site is positioned as a regional leader in transportation services, targeting commuters and travelers within these areas. Technically, the website is built on TYPO3 CMS with modern frontend frameworks like Bootstrap and Leaflet.js for mapping, ensuring a responsive and accessible user experience. Security-wise, the site enforces HTTPS and includes cookie consent mechanisms, though it lacks explicit security policies or vulnerability disclosures. Overall, the platform demonstrates a mature digital presence with good privacy compliance and trustworthy domain registration.

N

NETINERA

netinera-tickets.de

62

NETINERA operates a digital platform and app for the Deutschland-Ticket, a nationwide public transportation subscription in Germany. The company is a major player in the German regional transport sector, operating multiple subsidiary brands. The website provides comprehensive information about ticketing options, app usage, and subscription management, targeting private customers, students, apprentices, and employers. Technically, the site uses modern web standards, is hosted behind Cloudflare, and implements HTTPS with strong security headers. Privacy compliance is well addressed with clear policies and cookie consent mechanisms. However, explicit security policies and incident response contacts are not published. Overall, the website is professional, trustworthy, and well-optimized for its audience.

R

Regentalbahn GmbH

alex.info

57

The website www.laenderbahn.com/alex/ represents the alex regional train service operated by Regentalbahn GmbH, a subsidiary of the Netinera group. It offers daily direct train connections between Germany and the Czech Republic, targeting commuters and travelers in this region. The site provides comprehensive travel information, ticket sales, real-time updates, and customer service resources. The business model focuses on regional transportation services with a strong emphasis on customer convenience and cross-border connectivity. Technically, the website is built on Craft CMS and employs modern JavaScript libraries and frameworks such as jQuery and Mmenu for mobile navigation. It integrates multiple analytics and tracking tools including Matomo, Google Tag Manager, Facebook Pixel, and Hotjar, all managed with a cookie consent mechanism to comply with privacy regulations. The site is mobile-optimized, accessible, and SEO-friendly, providing a good user experience. From a security perspective, the website enforces HTTPS and uses CSRF tokens to protect forms. While explicit HTTP security headers were not detected in the provided data, the site follows best practices in data protection and privacy compliance, including a comprehensive privacy policy and cookie management. No vulnerabilities or exposed sensitive data were found. However, the absence of WHOIS data for the domain raises concerns about domain registration legitimacy, although the website branding and content strongly indicate a legitimate business. Overall, the site is professional, trustworthy, and well-maintained, serving its target audience effectively. The main risk lies in the missing WHOIS registration data, which should be verified externally. Strategic recommendations include enhancing HTTP security headers, publishing a vulnerability disclosure policy, and providing explicit incident response contacts to further strengthen security posture.

The Berchtesgadener Land Bahn website serves as the official online presence for a regional railway operator in Germany, providing schedules, ticketing information, and news updates related to the Freilassing to Berchtesgaden rail line. The business recently transitioned operations to Bayerische Regiobahn, indicating a shift in operational control. The website targets local passengers and public transport users, offering essential travel information and partner links. Technically, the site is built with basic HTML, CSS, and JavaScript without modern frameworks or CMS, resulting in moderate performance and limited mobile optimization. Security posture is weak, with no HTTPS enforcement or security headers detected, and no visible privacy or cookie policies, which poses compliance and trust concerns. Overall, the site is functional but lacks modern security and privacy best practices, limiting its digital maturity and user trust.

BILS Verkehrsbetriebe mbH is a German transportation company whose website is currently in maintenance mode, providing minimal content. The site uses WordPress CMS with jQuery and custom maintenance plugins. The technical infrastructure is basic but functional, with HTTPS enabled and a login form present. However, the absence of privacy, cookie, and terms of service policies, as well as lack of contact information, limits the site's professionalism and user trust. Security posture is moderate due to HTTPS but lacks important security headers and explicit security policies. Overall, the website's current state restricts comprehensive analysis and indicates a need for content and compliance improvements.

R

Regentalbahn GmbH

vogtlandbahn.de

57

The website www.laenderbahn.com/vogtlandbahn/ represents the Vogtlandbahn, a regional passenger rail service operating in the Vogtland region of Germany. It is part of Regentalbahn GmbH and affiliated with the parent company Netinera. The site offers comprehensive information on train schedules, ticketing options, real-time departure data, and customer services, targeting regional travelers and commuters. The business model focuses on providing reliable and comfortable regional rail transport connecting multiple cities and towns. The website is professionally designed with consistent branding and clear navigation, supporting a positive user experience. From a technical perspective, the site employs modern web technologies including JavaScript libraries, Matomo analytics, Google Tag Manager, and Facebook Pixel for tracking and marketing. It is built on Craft CMS and demonstrates good mobile optimization and accessibility features. Security is well addressed with HTTPS enforcement, security headers, and CSRF protection, though there is room for improvement in publishing explicit security policies and incident response information. The security posture is strong with no evident vulnerabilities or exposed sensitive data. Privacy compliance is robust, featuring a comprehensive privacy policy and cookie consent mechanisms aligned with GDPR requirements. Contact information is clearly provided, including phone numbers and physical addresses, enhancing business credibility. Overall, the website is a trustworthy and professional digital presence for a regional transportation provider. However, the absence of WHOIS registration details introduces some uncertainty about domain legitimacy, warranting further verification. Strategic recommendations include publishing a dedicated security policy, establishing a vulnerability disclosure program, and enhancing incident response transparency to further strengthen trust and compliance.

V

vlexx GmbH

vlexx.de

53

vlexx GmbH is a regional rail transport company operating in the German states of Rheinland-Pfalz, Hessen, and Saarland. The company provides passenger rail services with a focus on comfort, modern amenities, and sustainability. Their website offers comprehensive information on schedules, tickets, service, career opportunities, and leisure travel, targeting regional commuters and travelers. The company is positioned as a reliable regional transport provider with a medium-sized workforce and a solid market presence since its founding in 2014. The parent company is Netinera Deutschland GmbH, indicating a strong backing in the rail transport sector. Technically, the website is built on Craft CMS, uses modern JavaScript libraries, and is hosted behind Cloudflare, ensuring good performance and security. Privacy and cookie policies are present and GDPR compliant, though explicit terms of service and incident response policies are not found. Security posture is good with HTTPS and CSRF protections, but could be improved with additional security headers and vulnerability disclosure mechanisms. Overall, the website is professional, trustworthy, and well-structured for its audience.

O

Osthannoversche Eisenbahnen Aktiengesellschaft

ohe-ag.de

53

Osthannoversche Eisenbahnen Aktiengesellschaft (OHE) is a well-established transportation company based in Germany, specializing in regional rail and bus services primarily in Niedersachsen. Founded in 1944, OHE operates workshops and infrastructure services, positioning itself as a key regional player with a strong focus on reliability and customer satisfaction. The website reflects a professional digital presence with clear business information and a user-friendly interface. Technically, the site uses modern web technologies including Craft CMS, jQuery, and FontAwesome, hosted behind Cloudflare DNS services, and integrates Matomo for privacy-conscious analytics. Security posture is solid with HTTPS enforcement and cookie consent mechanisms, though formal security policies and incident response contacts are absent. Overall, the site is trustworthy, compliant with GDPR, and well-optimized for users.

O

ODEG – Ostdeutsche Eisenbahn GmbH

odeg.de

10

ODEG – Ostdeutsche Eisenbahn GmbH is the largest private railway operator in eastern Germany, providing regional passenger rail services. The company offers comprehensive information on schedules, fares, tickets, and customer service through its website. The business targets a broad audience including daily commuters and travelers in the region. The website demonstrates a moderate level of digital maturity, leveraging TYPO3 CMS and modern JavaScript libraries to deliver a responsive and user-friendly experience. Privacy compliance is well addressed with a comprehensive privacy policy and a cookie consent mechanism that includes retargeting disclosures. Security posture is adequate with HTTPS enforcement and no visible vulnerabilities, though the absence of a published security policy and incident response contacts suggests room for improvement. Overall, the website is professional, trustworthy, and aligned with the company's business objectives.

M

metronom Eisenbahngesellschaft mbH

der-metronom.de

56

metronom Eisenbahngesellschaft mbH operates regional passenger rail services connecting key northern German states including Niedersachsen, Hamburg, and Bremen. The company positions itself as a reliable regional transport provider with a focus on customer service, real-time travel information, and sustainable mobility. Their business model centers on providing scheduled train services, ticketing solutions, and substitute bus services during infrastructure works. The website reflects a medium-sized enterprise with consistent branding and a strong regional presence supported by partnerships with local transport authorities and the parent company Netinera. Technically, the website employs modern web technologies including Progressive Web App features, service workers, and integrates third-party widgets for travel planning. Hosting and DNS are managed via Cloudflare, ensuring good performance and security. The site is mobile-optimized, accessible, and SEO-friendly, with comprehensive metadata and structured content. From a security perspective, the site enforces HTTPS, uses standard security headers, and avoids exposing sensitive data. However, it lacks a dedicated security policy, incident response information, and vulnerability disclosure mechanisms, which are recommended for enhanced transparency and trust. Privacy compliance is well addressed with a comprehensive privacy policy and cookie consent mechanisms aligned with GDPR. Overall, the website is professional, trustworthy, and well-suited for its audience. Strategic improvements in security transparency and incident response readiness would further strengthen its posture.

D

Die Länderbahn GmbH DLB

laenderbahn.com

59

Die Länderbahn GmbH DLB is a well-established private railway company operating regional passenger transport services in Germany and the Czech Republic. With a history spanning over 130 years and multiple regional brands such as alex, trilex, and vogtlandbahn, the company holds a strong market position in the transportation sector. It is a subsidiary of NETINERA Deutschland GmbH, indicating a solid corporate backing. The website provides comprehensive information about the company’s services, history, and career opportunities, targeting both customers and potential employees. Technically, the website is built on a modern CMS platform (Craft CMS) and employs various analytics and marketing tools including Matomo, Google Tag Manager, Facebook Pixel, and Hotjar. The site is mobile-optimized with good SEO practices and a clear navigation structure. Security measures such as HTTPS and CSRF tokens are implemented, though some security headers and explicit incident response policies are absent. From a security and compliance perspective, the website includes a detailed privacy policy and cookie consent mechanism compliant with GDPR. However, the absence of WHOIS data for the domain raises questions about domain registration transparency, although the website content and branding strongly support legitimacy. No critical vulnerabilities or adult content were detected, and the site maintains a professional and trustworthy online presence. Overall, the website reflects a mature digital presence for a transportation company with good technical and privacy practices. Strategic improvements in security headers and public incident response information could further enhance trust and compliance.

L

Landesverkehrsgesellschaft Niedersachsen mbH (LNVG)

mobilotsin-niedersachsen.de

43

MOBILOTSIN is a regional initiative under the Landesverkehrsgesellschaft Niedersachsen mbH (LNVG) focused on supporting municipalities and counties in Lower Saxony, Germany, with innovative mobility concepts and the traffic transition. The website presents a professional and consistent brand image, offering services such as consulting, qualification courses, and events. The target audience primarily includes local government entities and stakeholders involved in mobility management. The digital infrastructure is built on the ProcessWire CMS with modern JavaScript libraries enhancing user experience. The site is mobile-optimized and well-structured, providing clear navigation and relevant content including event listings and newsletter subscription. From a security perspective, the website uses HTTPS and does not expose sensitive data in the HTML content. However, there is no evidence of advanced security headers or published security policies, and no cookie consent mechanism is present, which could be improved for better compliance. No analytics or tracking scripts were detected, indicating minimal user tracking. Contact information is clearly provided, enhancing business credibility. WHOIS data shows consistent domain registration with no privacy protection, aligning with the website's governmental affiliation. Overall, the website demonstrates a solid technical foundation and business credibility with room for improvement in privacy compliance and security best practices. The content is safe and appropriate for a general audience, with no adult or questionable material detected.

D

DPD

dpd.fr

68

DPD France operates as a major parcel delivery service provider, offering comprehensive shipping, tracking, and delivery management solutions for both professional and individual customers. The website reflects a mature digital presence with multilingual support and integration into the broader DPDgroup network. Technically, the site is built on WordPress with modern libraries such as jQuery and Bootstrap, ensuring responsive design and good user experience. Security posture is solid with HTTPS enforcement, cookie consent mechanisms, and fraud alert information, although explicit security policies and incident response details are not publicly disclosed. Overall, the site is trustworthy and professionally maintained, supporting DPD's market position in France and internationally.

D

DRiV

drivparts.com

63

DRiV is a company specializing in the manufacturing and distribution of quality automotive parts, targeting automotive professionals and parts buyers. The website presents a professional and consistent brand image with a focus on quality and safety in auto parts. Technically, the site is built on Adobe Experience Manager CMS and employs modern web technologies including jQuery, Vue.js components, and integrates tracking tools such as Google Tag Manager and Facebook Pixel. The site is accessible, mobile-optimized, and SEO-friendly, though accessibility features are basic. Security posture is moderate with HTTPS enabled but lacks visible security headers and formal privacy or cookie policies. The absence of WHOIS registration data is a significant concern, indicating potential issues with domain legitimacy or privacy protection. Overall, the site is functional and professional but requires improvements in privacy compliance and transparency to enhance trust and security.

L

Lease a Bike

lease-a-bike.de

62

Lease a Bike is a large German bike leasing service provider targeting companies, public employers, and employees. It offers a digital platform for bike leasing, enabling companies to provide bikes as employee benefits with minimal administrative effort. The company is affiliated with Volkswagen Financial Services AG and Pon.Bike, indicating strong market positioning and trust. The website is modern, well-designed, and optimized for mobile, featuring extensive customer testimonials and a comprehensive service offering. Technically, the site uses modern frameworks like Tailwind CSS, HubSpot forms, and Google Tag Manager, hosted behind Cloudflare DNS. Security posture is good with HTTPS and cookie consent mechanisms, though explicit security headers and policies are not fully documented. Privacy compliance is basic, with no explicit privacy or terms of service pages found in the provided content. Overall, the site is professional, trustworthy, and business-focused with a strong digital presence.

S

S-Bahn Berlin GmbH

sbahn-ebe.de

68

S-Bahn Berlin GmbH operates a dedicated online portal for managing the increased fare enforcement payments (Erhöhtes Beförderungsentgelt - EBE). The portal facilitates secure and quick payment of fines, submission of personalized tickets for review, and customer support for related inquiries. The website is professionally designed, mobile-optimized, and provides comprehensive FAQs and contact options, reflecting a mature digital presence for a public transportation entity. Technically, the site uses Drupal CMS, integrates UserCentrics for consent management, and employs Matomo for analytics, indicating a focus on privacy and compliance. Security measures include HTTPS, Content Security Policy with nonce, and CAPTCHA protections, contributing to a strong security posture. The domain WHOIS data is privacy protected but consistent with legitimate business use. Overall, the site demonstrates a high level of professionalism, trustworthiness, and compliance with GDPR and other regulations.

S

S-Bahn Berlin GmbH

abo-antrag.de

64

The website www.abo-antrag.de is an official online subscription management portal operated by S-Bahn Berlin GmbH, a medium-sized transportation company under Deutsche Bahn. It provides services for purchasing, managing, and canceling public transport subscriptions for Berlin and Brandenburg residents. The site is well-branded with official logos and integrates with partner domains such as sbahn.berlin and bahn.de. Technically, it is built on ASP.NET WebForms with modern JavaScript libraries and uses Adobe Analytics and Usercentrics for tracking and consent management, indicating a mature digital infrastructure. Security posture is adequate with HTTPS and consent mechanisms but lacks explicit security policies and vulnerability disclosure information. Overall, the site is professional, trustworthy, and compliant with GDPR, serving a general audience without any adult or questionable content.

B

BVG Jelbi

jelbi.de

62

Jelbi is a large-scale mobility platform operated by BVG Jelbi, integrating Berlin's public transport with various sharing services such as e-scooters, bikes, cars, and taxis. The website serves as an informational and promotional portal for the Jelbi app, targeting residents and visitors in Berlin. The business model focuses on providing a unified mobility experience through a single app, positioning Jelbi as a key player in Berlin's transportation ecosystem. Technically, the site is built on WordPress with the Divi theme, leveraging modern plugins and consent management tools like Didomi. The infrastructure is hosted on Cronon servers with proper HTTPS encryption and basic SEO optimizations. Security posture is solid with HTTPS and consent mechanisms, though explicit security headers and policies are absent. Privacy compliance is partial due to missing visible privacy and terms pages. Overall, the site is professional, trustworthy, and well-branded, with room for improvement in transparency and security documentation.

L

Landesnahverkehrsgesellschaft Niedersachsen mbH

lnvg.de

46

The Landesnahverkehrsgesellschaft Niedersachsen mbH (LNVG) is a government-affiliated organization responsible for planning, financing, and managing public transportation services in the German state of Niedersachsen. The website serves as an information hub for passengers, transport operators, and stakeholders, providing comprehensive details on regional rail and bus services, funding programs, infrastructure projects, and regulatory frameworks. The company holds a significant market position as a key public transport authority in the region. Technically, the website is built on TYPO3 CMS, a robust and widely used content management system, ensuring maintainability and scalability. The site employs Matomo analytics with an opt-out mechanism, reflecting a moderate level of privacy awareness. The site is mobile-optimized, accessible, and SEO-friendly, with a clear navigation structure and professional design. From a security perspective, the site uses HTTPS with a Content-Security-Policy header, indicating good baseline security practices. However, it lacks explicit cookie consent mechanisms and published security or incident response policies, which are areas for improvement. No vulnerabilities or suspicious content were detected. Overall, the website is trustworthy, professional, and well-aligned with its public service mission. Strategic enhancements in privacy compliance and security transparency would further strengthen its posture.

N

NETINERA Deutschland GmbH

netinera.de

57

NETINERA Deutschland GmbH is a major transportation company in Germany, operating since 2004 in regional rail and bus services. It is a subsidiary of Trenitalia, part of one of Europe's largest transport groups. The company offers a broad portfolio of rail and bus transport services along with maintenance and infrastructure support. The website reflects a mature business with a clear market position and extensive subsidiary network. Technically, the site uses SITEFORUM CMS and Bootstrap 3, with moderate performance and good mobile optimization. Security posture is adequate with HTTPS and cookie consent, but lacks visible security headers and explicit security policies. Overall, the site is professional, trustworthy, and compliant with GDPR, though improvements in security transparency and incident response readiness are recommended.

V

Verkehrsverbund Bremen/Niedersachsen GmbH (VBN)

vbn.de

64

Verkehrsverbund Bremen/Niedersachsen GmbH (VBN) operates as a regional public transportation authority providing integrated ticketing, timetable information, and mobility services across Bremen and Lower Saxony. The website serves a broad audience including commuters, families, students, and groups, offering comprehensive transport options and customer support. The business model focuses on facilitating seamless public transport usage through digital platforms and partnerships with transport operators. Technically, the website is built on TYPO3 CMS with modern JavaScript libraries such as jQuery, Bootstrap, and Leaflet for interactive maps and widgets. The integration of HAFAS public transport widgets enhances user experience for timetable and ticketing queries. The site is mobile-optimized, accessible, and SEO-friendly, reflecting a mature digital infrastructure. From a security perspective, the site enforces HTTPS, uses cookie consent mechanisms, and follows good security practices, though explicit security headers like Content-Security-Policy could be improved. No vulnerabilities or exposed sensitive data were detected. Privacy compliance is strong with clear GDPR-aligned policies and cookie management. Overall, the website presents a trustworthy, professional, and user-friendly platform supporting VBN's mission. Strategic improvements in security policy transparency and header implementation would further enhance its posture.

D

Dopravní koridor Poodří, z.s.

dopravnikoridorpoodri.cz

59

Dopravní koridor Poodří, z.s. is a Czech non-profit organization focused on advocating for transportation corridor development, particularly high-speed rail projects, in the Poodří region. The organization collaborates with multiple municipalities and regional authorities to influence infrastructure planning and environmental considerations. Their website serves as an information hub and communication platform for stakeholders and the public. Technically, the website is built on WordPress using the Avada theme and Fusion Builder framework, incorporating modern JavaScript libraries like Splide.js for interactive elements. The site is hosted under the REG-GRANSY registrar with consistent DNS settings. Performance and mobile optimization are good, though accessibility is basic. SEO practices are adequately implemented. From a security perspective, the site uses HTTPS with a good SSL configuration but lacks explicit security headers and a vulnerability disclosure policy. No critical vulnerabilities or exposed sensitive data were detected. Privacy and cookie policies are present and GDPR compliant, enhancing user trust. Overall, the website presents a professional and trustworthy front for the organization, with clear contact information and relevant content. Strategic improvements in security headers and incident response documentation could further strengthen their posture.

T

Tschudi Shipping Company AS

eml.ee

69

Tschudi Shipping Company AS is a well-established, family-owned Norwegian shipping and logistics group with a history dating back to 1883. The company offers a broad range of integrated services including shipping, ship management, transshipment, energy advisory, ocean industries support, offshore wind support, logistics, and financial services. With offices in 12 countries and a strong presence in the Nordics, Baltic, and Continental Europe, Tschudi Group positions itself as a reliable partner for maritime and logistics solutions worldwide. Technically, the website is built on the Webflow platform, utilizing modern web technologies such as jQuery, Google Analytics, and Google Tag Manager. The site is well-optimized for performance, mobile responsiveness, and SEO, providing an excellent user experience. Privacy and cookie policies are clearly presented with consent mechanisms, reflecting good privacy compliance practices. From a security perspective, the site uses HTTPS with good SSL configuration and anonymizes IPs in analytics. However, it lacks explicit security headers and does not provide a dedicated security policy or incident response contact information. The WHOIS data for the domain is incomplete or missing, which raises some concerns about domain registration transparency but does not directly contradict the legitimacy of the business given the strong branding and consistent subsidiary domains. Overall, the website demonstrates a high level of professionalism, trustworthiness, and technical maturity. The main risks relate to domain registration transparency and the absence of detailed security policies. Strategic recommendations include enhancing security headers, publishing incident response contacts, and verifying domain registration details to improve trust and compliance.

P

PagFerry.com

pagferry.com

45

PagFerry.com is a small Croatian website providing up-to-date ferry schedules, real-time ferry status, weather forecasts, and webcam feeds for the Prizna - Žigljen ferry route. It serves a niche audience of travelers and locals seeking reliable maritime transport information. The website is well-branded and consistent, with a clear focus on transportation services in the Croatian region. Technically, the site leverages modern web technologies including AMP for mobile optimization, jQuery, Bootstrap, and integrates third-party services such as Google Analytics and Facebook SDK for analytics and social media engagement. The site is mobile-friendly and offers a good user experience with clear navigation and relevant content. Security-wise, the site uses HTTPS and registers a service worker, but lacks visible security headers and explicit privacy or terms of service pages, which are areas for improvement. The WHOIS data for the domain is missing or indicates the domain may not be registered, which raises concerns about domain legitimacy despite the professional appearance of the site. Overall, the site is functional and useful but would benefit from enhanced security practices and verified domain registration to improve trustworthiness.

H

Hrvatske ceste d.o.o.

hrvatske-ceste.hr

63

Hrvatske ceste d.o.o. is a Croatian state-owned company responsible for the management, construction, reconstruction, and maintenance of the national road network. The website reflects its official status with consistent branding and clear presentation of its services and public information. The target audience includes government entities, contractors, drivers, and the general public interested in road infrastructure and related services. The company operates under the ownership of the Republic of Croatia, positioning itself as the authoritative body for state roads.

S

SHOEI CO., LTD.

shoei.com

59

SHOEI CO., LTD. is a globally recognized premium motorcycle helmet manufacturer with a strong market presence and a network of regional distributors worldwide. The website serves as a hub for worldwide distributor contacts and product information tailored to regional markets. The company targets motorcycle riders and distributors, emphasizing safety, design, and performance in its product offerings. Technically, the website employs modern JavaScript libraries and tracking tools, including Google Analytics, Facebook SDK, and Line Tag, indicating a mature digital infrastructure. The site is mobile-optimized with good navigation and professional design, though it lacks some privacy and security policy disclosures. Security posture is solid with HTTPS enforced and no visible vulnerabilities, but the absence of security headers and incident response information suggests room for improvement. The WHOIS data is unavailable, which raises some concerns about domain registration transparency but does not detract from the professional presentation and legitimacy of the business. Overall, the website is safe, professional, and functional, with recommendations to enhance privacy compliance and security transparency.

H

Hrvatski autoklub

hak.hr

66

Hrvatski autoklub (HAK) is a well-established national automobile club in Croatia, founded in 1997, providing a broad range of services including roadside assistance, travel and traffic information, driver education, and vehicle technical inspections. The website reflects a mature digital presence with comprehensive content tailored to drivers and vehicle owners in Croatia. The technical infrastructure leverages modern web technologies such as jQuery and Google Fonts, hosted with Cloudflare DNS, and includes a cookie consent mechanism aligned with GDPR requirements. Security posture is solid with HTTPS enabled and no visible vulnerabilities, though improvements in security headers and incident response disclosures are recommended. Overall, the website is professional, trustworthy, and serves its audience effectively.

Ž

ŽUPANIJSKA UPRAVA ZA CESTE LIČKO-SENJSKE ŽUPANIJE

zuc-ls.hr

45

ŽUPANIJSKA UPRAVA ZA CESTE LIČKO-SENJSKE ŽUPANIJE is a Croatian regional government agency responsible for the management and maintenance of roads within Ličko-Senjska County. The website serves as an official communication channel providing public notices, procurement information, road maps, and contact details to residents, contractors, and stakeholders. The agency positions itself as a trusted authority in transportation infrastructure within the region. Technically, the website is built on WordPress with Elementor and several plugins, offering a modern, mobile-optimized, and accessible user experience. Security posture is strong with HTTPS and security headers, though it lacks published security policies and cookie consent mechanisms. Overall, the site is professional, trustworthy, and serves its public function effectively.