Security Directory

L

Luminor Bank AS

luminor.ee

40

Luminor Bank AS operates as a leading financial institution in the Baltic region, offering a comprehensive suite of banking services including payments, loans, savings, investments, and private banking. The website targets both retail and business customers and positions itself as the third largest financial services provider in the Baltics. The digital presence is built on modern web technologies such as React and integrates tools like Google Tag Manager and LiveChat for enhanced user engagement. However, the website suffers from a critical security flaw due to the absence of a valid SSL certificate, exposing users to potential data interception risks. Privacy and cookie policies are well implemented and GDPR compliant, reflecting a strong commitment to user data protection. Overall, while the business credibility and content quality are high, the security posture requires urgent improvement to meet industry standards and protect customer data effectively.

C

Casavo Management S.p.A.

casavo.com

59

Casavo Management S.p.A. operates a mature and professional PropTech platform focused on simplifying the real estate transaction process for home sellers and buyers primarily in Italy and France. The company leverages technology such as machine learning algorithms for instant home valuation, combined with human consultancy and support services including mortgage assistance and professional home enhancement. Their market position is supported by significant funding, a growing presence in multiple European cities, and strong brand recognition through media coverage and verified customer testimonials. Technically, the website is built on modern frameworks like Next.js and React, hosted via Cloudflare, and integrates various third-party services for analytics and consent management. However, the website suffers from critical security shortcomings, notably the absence of a valid SSL certificate and HTTPS support, which severely impacts its security posture and user trust. Privacy compliance is robust, with clear GDPR-aligned policies and consent mechanisms in place. Overall, while the business model and digital maturity are strong, immediate remediation of security vulnerabilities is essential to protect user data and maintain credibility.

J

JSC Credit Information Bureau

manakreditvesture.lv

40

JSC Credit Information Bureau (KIB) operates the website manakreditvesture.lv, providing credit information and risk management services in Latvia. As part of the global Creditinfo Group and backed by major Latvian banks, it offers individuals and companies access to credit reports, credit scores, dispute management, and profile monitoring. The business model includes free and subscription-based services, targeting Latvian consumers and financial institutions. The website is built on a modern React and Gatsby stack, offering a good user experience and clear navigation, though performance is somewhat slow. Security posture is weak due to the absence of a valid SSL certificate and lack of security headers, which poses a significant risk. Privacy compliance is basic but present, with a privacy policy aligned with GDPR. Contact information is clearly provided, enhancing business credibility. Overall, the site is functional but requires urgent security improvements to protect user data and build trust.

G

Generalitat de Catalunya

atm.cat

66

Autoritat del Transport Metropolità (ATM) is a public consortium under the Generalitat de Catalunya, managing integrated transport tariffs and mobility projects in the Barcelona metropolitan area. The website serves as an official portal providing comprehensive information about transport tariffs, mobility plans, transparency, and customer support. It targets residents and public transport users in Catalonia, offering multilingual content and links to related government services. The business model is public sector focused, emphasizing transparency and service delivery rather than commercial revenue. Technically, the website is built on the Liferay CMS platform with modern web technologies including React and Bootstrap. While the site is content-rich and accessible, performance is hindered by a high load time and large page size. The site is mobile optimized and includes accessibility features. SEO and metadata are well implemented, including Open Graph tags. Security posture is adequate with HTTPS enforced, valid SSL certificates, and email authentication via DMARC and SPF. However, advanced security headers like HSTS and DNSSEC are missing, and domain protection locks are not enabled, which could be improved. No critical vulnerabilities or exposed sensitive data were detected. Privacy compliance is strong with clear cookie and privacy policies and consent mechanisms. Overall, the site is trustworthy and professionally maintained, reflecting its governmental nature. Recommendations include enhancing security headers, enabling DNSSEC, improving performance, and adding explicit security and incident response policies to further strengthen trust and compliance.

M

Mediarey Hungary Services Zrt.

forbes.hu

40

Forbes.hu is a mature Hungarian business media website operated by Mediarey Hungary Services Zrt., providing high-quality business, finance, lifestyle, and culture content targeted at Hungarian-speaking professionals and general readers. The site uses a WordPress CMS with React components and integrates multiple advertising and tracking technologies to support its business model, which includes advertising and premium subscriptions. Technically, the site is hosted behind Cloudflare and uses modern web technologies but lacks a valid SSL certificate, resulting in HTTP-only access which is a significant security concern. Privacy and cookie policies are comprehensive and GDPR compliant, with a consent mechanism implemented via Cookiebot. The WHOIS data confirms the domain's maturity and legitimacy, consistent with the business claims. Overall, the site is professionally designed and content-rich but requires urgent security improvements to enable HTTPS and strengthen its security posture.

S

StoryToys Limited

marvelhq.com

56

MarvelHQ.com is a digital content publishing website for the Marvel HQ app, published by StoryToys Limited, a Team17 company. The site offers access to games, videos, books, comics, and activities featuring Marvel characters, targeting a family audience. The business operates in the media and entertainment sector with a focus on licensed digital content distribution across multiple platforms including iOS, Android, Amazon, and Samsung stores. The website is professionally designed with consistent branding and clear calls to action for app downloads.

F

FUNDACION DEL MUSEO GUGGENHEIM BILBAO

guggenheim-bilbao.eus

31

The Museo Guggenheim Bilbao is a prominent non-profit cultural institution based in Bilbao, Spain, managed by the FUNDACION DEL MUSEO GUGGENHEIM BILBAO. The website serves as a comprehensive portal for visitors to plan their visits, explore exhibitions, and access educational resources. It targets a broad audience interested in art, culture, and museum experiences. The museum holds a strong market position as an internationally recognized art venue with strategic partnerships and sponsorships from government and corporate entities. Technically, the website leverages modern web technologies including Next.js and React, with a headless WordPress CMS backend. It integrates accessibility tools and multimedia content hosted on Vimeo. The site is mobile-optimized and SEO-friendly, providing a good user experience and navigation clarity. From a security perspective, the site currently lacks a valid SSL certificate and does not support modern TLS protocols, which is a critical vulnerability impacting user trust and data security. Other security headers and best practices are partially implemented, but the absence of HTTPS significantly lowers the security posture. Overall, the website is professionally designed and content-rich, but the lack of HTTPS is a major risk. Strategic recommendations include immediate SSL/TLS deployment, enabling HSTS, and improving certificate management to enhance security and user trust.

P

Privacy service provided by Withheld for Privacy ehf

linkjago.me

58

Link Jago is a small, technology-focused business offering a free and open source URL shortening service with features such as custom domains, link management, statistics, and API access. The service targets users and developers seeking an alternative to proprietary URL shorteners, positioning itself as a niche open source solution. The website is built using modern web technologies including Next.js and React, hosted behind Cloudflare DNS, and integrates Google reCAPTCHA for bot protection. However, the site suffers from slow load times and lacks a valid SSL/TLS certificate, resulting in no HTTPS support which is a critical security concern. Security headers are minimal, with only HSTS enabled, and no DMARC or DNSSEC records are present. Privacy compliance is weak, with no privacy or cookie policies found, and no contact or incident response information provided. The domain is registered with privacy protection, which is reasonable for a small open source project but reduces transparency. Overall, the site demonstrates moderate professionalism and technical maturity but requires significant improvements in security and privacy compliance to enhance trust and protect users.

F

FX

fxnetworks.com

50

FX Networks operates as a prominent media and entertainment company specializing in critically acclaimed dramas, comedies, and original documentaries. The website serves as the official platform for FX and FXX, offering streaming content primarily through Hulu. The company holds a strong market position with a focus on original programming and a partnership with Hulu for content distribution. Technically, the website is built on modern frameworks such as Next.js and React, leveraging Akamai CDN and AWS Lambda for hosting and content delivery, indicating a mature digital infrastructure. However, the security posture is weak due to the absence of a valid SSL certificate and HTTPS support, which is a critical vulnerability. Privacy compliance is also lacking, with no visible privacy or cookie policies and no explicit contact information for users. Overall, while the website excels in content quality and business credibility, it requires urgent improvements in security and privacy compliance to enhance trust and protect user data.

T

The Walt Disney Company

disneynow.com

49

DisneyNOW is a digital streaming platform operated by The Walt Disney Company, offering a wide range of Disney Channel, Disney Junior, and Disney XD shows, movies, and video clips targeted primarily at children and families. The platform is well-branded and professionally designed, providing an excellent user experience with clear navigation and rich content offerings. Technically, the site uses modern web technologies including React, Nginx, Varnish Cache, and AWS hosting, along with performance monitoring via New Relic. However, the site suffers from a critical security issue due to an invalid SSL certificate, which undermines the security posture and user trust. Privacy policies and terms of service are comprehensive and properly linked, indicating good compliance with privacy regulations such as GDPR. Overall, the site is a high-quality media platform with strong business credibility but requires urgent remediation of its SSL configuration to improve security and trust.

D

Dauphin Telecom

topup.fr

40

Dauphin Telecom TopUp operates as a regional telecommunications service provider specializing in mobile credit recharge and related services for customers primarily in the French Caribbean region. The website offers a user-friendly platform for purchasing mobile credit, voice, and internet passes, supported by a mobile app and a network of resellers. The business targets individual consumers and resellers, positioning itself as a convenient and economical solution for mobile recharge needs. Technically, the site is built on the Wix platform using modern React frameworks and integrates various Wix services such as video, gallery, and forms. However, the absence of a valid SSL certificate and lack of HTTPS significantly undermine the site's security posture. While basic privacy and cookie policies are present, they lack explicit consent mechanisms, and no dedicated security or incident response policies are found. The site demonstrates moderate digital maturity but requires urgent improvements in security to protect user data and build trust. Strategic recommendations include obtaining a valid SSL certificate, enabling modern TLS protocols, and enhancing privacy compliance measures.

P

Privacy service provided by Withheld for Privacy ehf

mikale.me

59

Mikale is a small technology company operating a free and open source URL shortening service. The website offers core services such as URL shortening with custom domains and link statistics, targeting developers and users needing link management solutions. The business is relatively new, founded in 2023, and uses modern web technologies including Next.js and React, hosted behind Cloudflare. The site is accessible and well-structured with good design and user experience, but lacks formal privacy, cookie, and terms of service policies, as well as explicit contact information. Security posture is weak due to the absence of a valid SSL/TLS certificate and lack of HTTPS, which is a critical issue for user trust and data protection. The domain is privacy protected, which is common for small tech projects, and shows no signs of suspicious activity or subdomain takeover vulnerabilities.

W

websolute spa

websolute.com

63

Websolute spa is a medium-sized Italian digital company specializing in comprehensive digital services including strategy, branding, demand generation, e-commerce, technology, and artificial intelligence. The company positions itself as a digital partner for ambitious brands aiming for global market presence. Technically, the website is built on modern frameworks such as Next.js and React, hosted on Cloudflare, and uses Pimcore as CMS, ensuring good performance and mobile optimization. Security posture is solid with valid SSL and Cloudflare protection, though improvements like HSTS and additional security headers are recommended. Privacy and cookie policies are present and GDPR compliant, but no explicit terms of service or incident response policies were found. Overall, the website demonstrates high professionalism, rich content, and strong business credibility, supported by a portfolio of reputable clients and subsidiaries. The domain registration data aligns well with the business claims, indicating a trustworthy and legitimate entity.

ABC.com is the official website of ABC Entertainment, a leading US media company under The Walt Disney Company. The site offers extensive content including TV shows, news, live streams, and special events across multiple platforms such as Hulu, Disney+, FX, Freeform, and National Geographic. The website demonstrates a high level of digital maturity with a modern tech stack including React and comprehensive integration with analytics and advertising platforms. However, a critical security issue is the absence of a valid SSL certificate, which undermines secure HTTPS communication. Privacy and cookie policies are comprehensive and GDPR compliant, reflecting a strong commitment to user privacy. Overall, the site is professionally designed, user-friendly, and content-rich, serving a broad US audience with high-quality media content.

A

ABC News

goodmorningamerica.com

51

GoodMorningAmerica.com is the official website for Good Morning America, a flagship morning news and lifestyle program under ABC News, owned by The Walt Disney Company. The site offers a rich mix of news, entertainment, lifestyle content, and affiliate e-commerce deals, targeting a broad audience interested in current events, culture, wellness, and shopping. The website is professionally designed with consistent branding and a strong social media presence, reflecting its position as a major media enterprise in the United States. Technically, the site leverages modern web technologies including React, AWS CloudFront CDN, and tag management tools like Google Tag Manager and Ensighten. The site is mobile-optimized and SEO-friendly, with comprehensive metadata and structured content. However, the SSL/TLS configuration is currently invalid, with no valid certificate and no modern TLS protocols enabled, which poses a significant security risk and impacts user trust. From a security perspective, while the site does not exhibit common vulnerabilities such as Heartbleed or POODLE, the lack of a valid SSL certificate and absence of security headers like HSTS reduce its security posture. Privacy policies and terms of service are comprehensive and hosted on Disney domains, indicating good privacy compliance. Contact information is limited to a web form, with no direct emails or phone numbers publicly listed. Overall, the website is a high-quality, authoritative media platform with excellent content and business credibility. The primary risk lies in its SSL/TLS misconfiguration, which should be addressed promptly to ensure secure user connections and maintain trust. Strategic improvements in security configuration and enhanced accessibility features would further strengthen the site’s digital maturity and user confidence.

A

Address Hotels

addresshotels.com

40

Address Hotels + Resorts is a luxury hospitality brand offering five-star hotels and resorts in iconic locations, primarily in the Middle East. The website presents a comprehensive and professional digital presence with rich content, multiple language support, and integrated booking and dining reservation systems. The technical infrastructure is based on WordPress with modern web technologies such as React, jQuery, Bootstrap, and Flickity, hosted on Azure CDN. However, the absence of a valid SSL certificate and lack of modern TLS protocols represent critical security vulnerabilities that must be addressed to ensure secure user interactions and data protection. Privacy compliance is partially met with a comprehensive privacy policy and terms of service, but lacks explicit cookie consent mechanisms. Overall, the site demonstrates strong business credibility and branding consistency but requires urgent security improvements.

I

ISS

issworld.com

40

ISS is a global leader in workplace experience and facility management services, operating in over 30 countries with more than 325,000 employees and 40,000 customers. The company offers integrated services including cleaning, food, technical, workplace, and facility management solutions designed to improve business performance and employee wellbeing. The website reflects a mature digital presence with multi-language support, comprehensive corporate and investor information, and active social media engagement. Technically, the site is built on modern frameworks such as Next.js and hosted on Vercel, with Sitecore as the CMS, indicating a robust and scalable infrastructure. However, the security posture is weakened by the absence of a valid SSL certificate and incomplete HSTS implementation, which are critical issues that need immediate remediation to protect user data and maintain trust. Privacy compliance is well addressed with clear policies and consent mechanisms. Overall, the site is professional and trustworthy but requires urgent security improvements.

Energreen is a mature Belgian company specializing in high-quality, sustainable energy solutions including solar panels, home batteries, electric vehicle charging stations, heat pumps, and intelligent energy management systems. The company positions itself as a comprehensive provider for both residential and commercial customers, emphasizing energy independence and cost reduction. The website is built on modern technologies such as Next.js and React, hosted on AWS Cloudfront, and integrates multiple analytics and marketing tools with user consent mechanisms. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS, which significantly impacts the security posture. The company provides clear contact information and maintains comprehensive privacy and cookie policies, supporting GDPR compliance. Overall, the website is professional and content-rich but requires urgent security improvements to protect user data and enhance trust.

A

AC Milan

acmilan.com

28

AC Milan's official website serves as a digital platform for the football club to engage with fans by providing news, match information, and multimedia content. The site targets football enthusiasts and supporters of the club, leveraging a React-based frontend and delivery through AWS CloudFront CDN. Despite its global brand recognition, the website currently lacks a valid SSL certificate, resulting in no HTTPS support, which critically undermines its security posture. The absence of privacy and terms of service pages further impacts compliance and user trust. The cookie consent mechanism via OneTrust and integration of Google Tag Manager indicate some level of privacy and analytics maturity, but overall content quality and navigation are basic, with minimal visible business contact information.

W

Wise

transferwise.com

60

Wise is a leading global fintech company specializing in international money transfers, multi-currency accounts, and investment services. The company operates with a strong regulatory framework across multiple jurisdictions including Belgium, Estonia, Singapore, Australia, Canada, Malaysia, Japan, and Hong Kong. Its platform supports a wide range of currencies and payment methods, serving both personal and business customers worldwide. The website reflects a mature digital presence with comprehensive content, clear navigation, and extensive use of modern web technologies. However, a critical security issue is present due to an invalid SSL certificate and lack of modern TLS protocols, which significantly impacts the security posture. Despite this, the company demonstrates strong compliance with privacy regulations and maintains transparent advertising and analytics practices.

T

Title Forward

titleforward.com

52

Title Forward is a specialized title and settlement services company operating primarily in the United States, founded in 2012. The company leverages technology combined with traditional expertise to provide title insurance and settlement services across multiple states. Their market position is that of a customer-focused, technology-enabled service provider offering competitive pricing and personal service. The website reflects a professional and consistent brand with clear navigation and relevant content targeted at homebuyers and homeowners. Technically, the site uses modern frameworks such as React and is hosted on AWS infrastructure with CDN support, ensuring moderate performance and good mobile optimization. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts the security posture. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, the business credibility is strong, supported by partner logos and social media presence, but the security weaknesses require urgent remediation.

B

Bay Equity LLC

bayequityhomeloans.com

40

Bay Equity LLC operates as a full-service home mortgage lender in the United States, licensed in 48 states and DC. The company offers a range of home loan products including first-time homebuyer loans, refinancing options, and specialty loans such as FHA, Jumbo, VA, and USDA loans. Their market position is supported by a broad network of local teams and a focus on personalized service through dedicated loan officers. The website is professionally designed with clear navigation and comprehensive content aimed at homebuyers and current homeowners. Technically, the website is built on a modern React and Gatsby framework, hosted on Netlify, indicating a contemporary and scalable infrastructure. While the site is mobile-optimized and includes accessibility features, performance metrics are not available for a complete assessment. The site employs cookie consent mechanisms and integrates third-party marketing and tracking tools responsibly. From a security perspective, the site lacks a valid SSL certificate and does not support modern TLS protocols, which is a critical vulnerability that undermines user trust and data protection. Security headers are partially implemented, but important features like HSTS are not fully enabled. No explicit security or incident response policies are found, and there is no vulnerability disclosure or security.txt file. Overall, the business appears legitimate and well-established, but the critical security issues related to SSL/TLS must be addressed immediately to ensure secure user interactions and compliance with best practices. Strategic recommendations include fixing the SSL configuration, enabling strong security headers, and enhancing transparency around security policies.

A

ApartmentGuide

apartmentguide.com

48

ApartmentGuide is a large-scale online real estate platform specializing in apartment rentals across the United States. It offers a comprehensive apartment search tool with listings, reviews, photos, and floor plans, targeting renters and property managers. The platform integrates with major networks such as Rent.com and Redfin, enhancing its market reach. Technically, the site employs modern web technologies including React and Next.js, hosted on AWS CloudFront CDN, and uses analytics tools like Datadog RUM and Google Tag Manager. However, the security posture is weak due to the absence of a valid SSL certificate and HTTPS support, lack of security headers, and no visible privacy or cookie policies, which raises concerns about user data protection and compliance. The site extensively tracks users without clear consent mechanisms, impacting privacy compliance. Overall, while the business model and technical infrastructure are solid, significant improvements in security and privacy compliance are necessary to enhance trust and protect users.

R

Rent.com

rent.com

48

Rent.com operates as a large-scale online real estate rental marketplace focused on providing users in the United States with access to apartments, houses, condos, and townhouses for rent. The platform offers key services such as property search, saved listings, rental price estimation, and business solutions for landlords. The website is built on modern web technologies including React and Next.js, hosted on AWS CloudFront, and integrates analytics and marketing tools like Datadog RUM and Google Tag Manager. However, the site currently lacks a valid SSL certificate, resulting in no HTTPS support, which is a critical security deficiency. Additionally, privacy and cookie policies are not detected, and no explicit contact information is provided, which impacts user trust and compliance. The domain registration data aligns well with the business claims, showing consistent DNS and MX records without privacy protection masking. Overall, while the business model and technical infrastructure are solid, the security posture and privacy compliance require urgent improvements to enhance trustworthiness and user safety.

A

airfocus

airfocus.com

53

airfocus is a modular product management SaaS platform designed to help product teams manage strategy, prioritize roadmaps, and align stakeholders effectively. The company positions itself as an enterprise-ready solution with strong integrations such as Jira, targeting product managers and teams seeking flexible and scalable product management tools. The website content is rich, professionally designed, and includes multiple trust indicators such as certifications and customer testimonials, reflecting a mature business presence. Technically, the website is built using modern technologies including React and Gatsby, hosted on Google Cloud infrastructure. While the site demonstrates good SEO and mobile optimization, performance metrics are not explicitly available. Security headers are implemented, but the SSL/TLS configuration is critically flawed with an invalid certificate and no TLS protocols enabled, significantly impacting the security posture. The security posture shows strengths in header implementation and compliance certifications (ISO 27001, SOC2, GDPR), but the lack of a valid SSL certificate and missing cookie consent mechanisms are notable weaknesses. No incident response or vulnerability disclosure information is publicly available, which could be improved to enhance trust. Overall, the website is professional and trustworthy from a business perspective but requires urgent remediation of SSL/TLS issues to ensure secure user interactions and compliance with best practices. Strategic recommendations include fixing the SSL certificate, enabling modern TLS protocols, implementing cookie consent, and publishing incident response details to strengthen security and privacy compliance.

L

Lucid Software Inc.

lucid.co

56

Lucid Software Inc. operates a leading visual collaboration and work acceleration platform designed to empower teams across various industries to innovate and execute faster. The company serves a broad enterprise audience including product, engineering, IT, project management, and executive teams, with a strong presence in the Fortune 500. Their SaaS offerings include virtual whiteboarding, intelligent diagramming, and enterprise accelerators for Agile, cloud, and process improvements. Technically, the website is built on modern frameworks like React and Gatsby, providing a professional and accessible user experience. However, the SSL certificate is currently invalid or missing, which impacts the security posture. Security headers are well implemented, and privacy compliance is supported by a comprehensive privacy policy and cookie consent mechanism. Overall, the website demonstrates high professionalism and trustworthiness but should address SSL issues to improve security and user trust.

R

Redfin

redfin.ca

46

Redfin.ca is a professional online real estate platform serving the Canadian market, offering home search, rentals, mortgage services, and local real estate agent assistance. The company is a large, established player in the real estate industry with a strong brand presence and multiple subsidiaries. The website content is rich, well-structured, and targets home buyers, sellers, and renters effectively. Technically, the site uses modern web technologies such as React and integrates with Google Tag Manager and AWS WAF SDK, but suffers from slow load times and lacks a valid SSL certificate, which severely impacts security posture. Privacy policies and cookie consent mechanisms are present and indicate GDPR compliance, enhancing user trust. However, the absence of HTTPS and modern TLS protocols is a critical security vulnerability that must be addressed immediately to protect user data and maintain credibility.

A

Achmea Reinsurance

achmeareinsurance.com

53

Achmea Reinsurance operates as the reinsurance competence centre within the Achmea Group, primarily serving group companies and selectively offering life reinsurance to third parties. The company is positioned as a key risk carrier and advisor within the finance sector, located in Tilburg, Netherlands. The website reflects a professional business presence with clear descriptions of its roles and services. Technically, the site is built on Sitecore CMS with React framework components, but suffers from slow load times and lacks a valid SSL certificate, which critically impacts security posture. The absence of HTTPS and modern TLS protocols exposes the site to potential risks and undermines user trust. Privacy and cookie policies are present but basic, and no explicit contact emails or phone numbers are published, relying instead on a contact form. Overall, the site demonstrates moderate digital maturity but requires urgent security improvements to align with best practices and regulatory compliance.

A

Achmea Real Estate

achmearealestate.nl

40

Achmea Real Estate is a well-established Dutch real estate investment manager with over 60 years of experience managing a large portfolio on behalf of institutional investors. The company focuses on sustainable investments with social impact and financial returns. The website reflects a professional business presence with good content quality and consistent branding. Technically, the site uses modern frameworks such as React and Sitecore CMS, but suffers from slow load times and lacks a valid SSL certificate, which is a critical security flaw. Privacy and cookie policies are present and GDPR compliant, but no explicit contact information or security policies are found. Overall, the security posture is weak due to missing HTTPS and security headers, which poses risks to user trust and data protection. Strategic improvements in SSL deployment and security configurations are recommended to enhance trust and compliance.

A

Achmea

achmeamortgages.nl

40

Achmea Mortgages operates as a specialized financial services provider focusing on mortgage investments within the Dutch market. The company offers investment funds, market insights, and ESG-related reporting, targeting investors and financial professionals interested in mortgage-backed assets. The website reflects a mature business presence with consistent branding and professional content, although direct contact information is not prominently displayed. Technically, the website is built on a modern stack including React and Sitecore CMS, with integrations for consent management and analytics. However, performance is suboptimal with a slow page load time exceeding 12 seconds, which could affect user engagement. Mobile optimization and SEO appear adequate, but accessibility is basic. From a security perspective, the absence of a valid SSL certificate and HTTPS support is a critical vulnerability, severely impacting the site's security posture. Additionally, the lack of security headers and modern TLS protocols further exposes the site to risks. Privacy compliance is strong, with clear cookie and privacy policies and a consent mechanism in place. Overall, while the business credibility and content quality are good, the security deficiencies significantly reduce the trustworthiness and safety of the website. Immediate remediation of SSL and HTTPS issues is recommended to protect users and improve the site's security rating.

A

Achmea

achmeaglobalneth.nl

40

Achmea GlobalNeth is a service provider specializing in claims and risk management for insurers and risk managers, primarily operating in the Netherlands and internationally. The website presents a professional image with clear service offerings and a strong partner network. Technically, the site uses modern frameworks such as React and Sitecore CMS but suffers from significant security shortcomings, notably the absence of a valid SSL certificate and HTTPS support, which severely impacts the security posture. Performance is also a concern due to slow load times. Privacy compliance is well addressed with clear cookie and privacy policies. Overall, the site is credible but requires urgent security improvements to protect user data and enhance trust.

A

Achmea Foundation

achmeafoundation.nl

40

Achmea Foundation is a non-profit organization focused on sustainable social impact in the Netherlands and Sub-Sahara Africa, operating under the parent company Achmea. The foundation delivers impact through funding, volunteering, and community programs. The website is professionally designed and content-rich, targeting stakeholders interested in social projects and collaborations. Technically, the site uses modern frameworks like React and Sitecore CMS, hosted likely on Microsoft Azure infrastructure. However, the website suffers from critical security shortcomings, notably the absence of a valid SSL certificate and HTTPS support, which severely impacts its security posture. Privacy policies are present and linked to the parent company, indicating good privacy compliance. Overall, the site is trustworthy but requires urgent security improvements to protect users and data.

A

Achmea Bank

achmeabank.nl

40

Achmea Bank is a significant financial institution in the Netherlands, operating as part of the larger Achmea group. It offers a range of financial products including savings, mortgages, and investment services through its brands Centraal Beheer, Acier, and Attens Hypotheken. The website reflects a professional and consistent brand presence targeting Dutch consumers interested in financial products. Technically, the site is built on modern frameworks such as React and managed via Sitecore CMS, hosted likely on Microsoft Azure infrastructure. However, a critical security gap exists due to the absence of a valid SSL/TLS certificate, resulting in no HTTPS support, which severely impacts the site's security posture. Security headers are present but insufficient without HTTPS. Privacy policies and cookie policies are well documented and GDPR compliant, but no explicit incident response or vulnerability disclosure mechanisms are publicly available. Overall, the site is trustworthy and professional but requires urgent security improvements to protect user data and maintain compliance.

L

Lucid Software Inc.

lucidchart.com

62

Lucid Software Inc. operates Lucidchart, a leading SaaS platform specializing in intelligent diagramming and visual collaboration. The company targets enterprise and team users seeking to optimize processes and systems through AI-powered diagramming and integrations with popular enterprise tools. The website reflects a mature digital presence with comprehensive content, strong branding, and a wide range of integrations and resources. Technically, the site is built on modern frameworks like Gatsby and React, hosted via Akamai, and employs security headers and privacy compliance mechanisms. However, a critical security concern is the invalid SSL certificate, which undermines the overall security posture. Despite this, the company maintains good privacy policies and legal documentation, supporting GDPR compliance. Overall, Lucidchart presents a professional and trustworthy platform with room for security improvements.

S

SailPoint Technologies, Inc.

sailpoint.com

71

SailPoint Technologies, Inc. is a leading enterprise software company specializing in identity security solutions that help organizations manage and protect all types of enterprise identities. The company holds a strong market position with recognition from Gartner, KuppingerCole, and Frost & Sullivan, serving a global enterprise audience including many Fortune 500 companies. Their core offerings include Identity Security Cloud, IdentityIQ software, and advanced capabilities such as machine identity security and AI-driven automation through Harbor Pilot. The website reflects a mature digital presence with comprehensive content, multilingual support, and a professional design that targets security leaders and IT professionals. Technically, the website is built on modern frameworks such as Next.js and React, hosted on Vercel with Cloudflare CDN integration. It employs a variety of third-party marketing, analytics, and security tools including Google Analytics, Hotjar, Marketo, and Bugcrowd. While the site is mobile optimized and accessible, performance is moderate and could benefit from further optimization. The SSL configuration is currently invalid or missing, which is a critical security concern that impacts the overall security posture. From a security perspective, the site implements a robust Content Security Policy and several security headers but lacks full HSTS enforcement and OCSP stapling. No critical vulnerabilities or exposed sensitive data were detected. Privacy compliance is well addressed with clear privacy and cookie policies and GDPR compliance indicators. Contact information is primarily provided via forms and external portals, with security-related contact emails identified. Overall, the website demonstrates a high level of professionalism and trustworthiness, supported by strong business credibility and industry recognition. However, the invalid SSL certificate is a significant risk that should be addressed promptly to maintain user trust and security integrity.

S

Shopify

handshake.com

72

Shopify is a leading global e-commerce platform that empowers entrepreneurs and businesses to create, manage, and grow online stores with a comprehensive suite of tools including wholesale and B2B capabilities. The website content reflects a mature, well-established business with a strong market position and a focus on providing value to both small and large retailers. Technically, the site leverages modern frameworks such as React and is hosted on Cloudflare, ensuring fast performance and good accessibility. Security measures are robust with TLS 1.3 support and essential security headers, though improvements in HSTS configuration and certificate transparency compliance are recommended. The site maintains comprehensive privacy and legal policies, demonstrating good privacy compliance. Overall, the risk profile is low, with strong domain legitimacy and no detected vulnerabilities or blocking mechanisms.

1

1Password

1password.com

71

1Password is a mature and industry-leading technology company specializing in password management and extended access management solutions for individuals, families, and enterprises. The company offers a comprehensive suite of products including enterprise password management, device trust, and access governance, positioning itself strongly in the cybersecurity market. Their website reflects a professional and well-branded digital presence with clear messaging and extensive resources. Technically, the site leverages modern frameworks like Next.js and React, hosted on Cloudflare and Netlify, ensuring fast performance and good mobile optimization. However, critical security issues exist due to an invalid SSL certificate and lack of modern TLS protocol support, which significantly impact the security posture. Privacy and compliance documentation is comprehensive and GDPR compliant. Overall, 1Password demonstrates strong business credibility and digital maturity but must urgently address SSL and TLS issues to maintain trust and security.

A

Achmea

achmea.nl

40

Achmea is a mature and large Dutch insurance and financial services company serving approximately 10 million customers. The company emphasizes societal responsibility and sustainability in its business model, offering a broad range of insurance products and financial services through multiple subsidiary brands. The website reflects a professional corporate presence with good content quality and consistent branding. Technically, the site uses modern technologies such as React and Sitecore CMS, but suffers from slow load times and lacks a valid SSL certificate, which is a critical security issue. The security posture is weak due to missing HTTPS, lack of security headers, and incomplete DNS security configurations. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. The business credibility is strong, supported by extensive subsidiary networks and transparent corporate information. Overall, the site is functional but requires urgent security improvements to protect user data and maintain trust.

C

Cursor Inc.

cursor.io

53

Cursor Inc. is a Canadian-based web design and development company founded in 2018, specializing in delivering comprehensive digital services including strategy, design, development, marketing, and analytics. The company targets future-focused brands seeking innovative and transformative technology solutions. Their market position is that of a full-service digital agency with a focus on modern web technologies and user experience. The website content reflects a professional and consistent brand image with clear service offerings and a moderate social media presence. Technically, the site is built on modern frameworks such as React and Next.js, hosted on DigitalOcean, and uses Builder.io as a CMS. However, the website suffers from slow load times and lacks some accessibility features. From a security perspective, the site has critical issues including the absence of a valid SSL certificate, no HTTPS enforcement, and missing security headers, which significantly lowers its security posture. Privacy compliance is poor, with no visible privacy or cookie policies and no GDPR indicators. Contact information is limited to a contact form with no explicit emails or phone numbers. Overall, the site is functional and professional but requires urgent security and privacy improvements to enhance trust and compliance.

Y

Yelp

yelp.ch

56

Yelp.ch is a localized German-language website serving the Swiss market, providing user-generated reviews and recommendations for local businesses such as restaurants, shopping, nightlife, and wellness services. The platform operates under Yelp Inc., a well-established company founded in 2004, with a strong market position as a leading local business review platform. The website offers extensive business listings, search functionality, and advertising services for business owners. Technically, the site uses modern web technologies including React and GraphQL, hosted primarily on Amazon AWS infrastructure. However, performance is hindered by slow load times and a large page size. Security posture is weakened by an invalid SSL certificate and lack of HTTPS enforcement, absence of security headers, and no HSTS policy, which are critical areas for improvement. Privacy compliance is strong, with comprehensive privacy and cookie policies and GDPR adherence. Overall, the site is professional, trustworthy, and content-rich but requires urgent security enhancements to protect users and maintain trust.

Y

Yelp

yelp.ca

62

Yelp is a well-established online platform specializing in local business reviews and recommendations, serving consumers seeking trusted information about restaurants, services, and entertainment. The website demonstrates a high level of professionalism with excellent content quality, clear navigation, and a strong brand presence. Technically, Yelp employs modern web technologies including React and ES modules, supported by a robust CDN infrastructure. However, a critical security gap exists due to the absence of a valid SSL/TLS certificate, which undermines user trust and data security. Privacy policies and cookie consent mechanisms are comprehensive but GDPR compliance is not fully indicated. Overall, Yelp maintains a strong market position with enterprise-level scale and consistent domain registration practices.

S

Spacelift, Inc.

spacelift.io

62

Spacelift, Inc. operates a mature and reputable infrastructure orchestration platform that integrates with popular infrastructure as code tools such as Terraform, OpenTofu, Ansible, and others. The company targets DevOps and platform engineering teams, offering a SaaS and self-hosted solution to streamline infrastructure provisioning, configuration, governance, and collaboration. The website reflects a strong market position with endorsements from notable customers and partners, emphasizing secure, cost-effective, and high-performance infrastructure delivery. Technically, the website is built on modern frameworks including Next.js and React, hosted on Vercel, and employs a variety of analytics and marketing tools such as Segment, Google Analytics, and HubSpot. The site is well-optimized for SEO, mobile responsiveness, and accessibility, providing an excellent user experience. However, the SSL certificate is currently invalid or misconfigured, and modern TLS protocols are not enabled, which impacts the security posture. Security-wise, the site implements several best practices including strict transport security headers, content security policies, and XSS protections. Despite this, the lack of a valid SSL certificate and absence of OCSP stapling are notable weaknesses. Privacy compliance is well addressed with clear privacy and cookie policies, including consent mechanisms, and GDPR compliance indicators. Overall, Spacelift demonstrates a strong business and technical foundation with minor security and compliance gaps. Addressing SSL issues and enhancing security configurations will further strengthen trust and protect user data.

Y

Yelp

yelp.fi

70

Yelp.fi is the Finnish localized version of Yelp, a leading online platform providing user-generated reviews and business listings primarily for the Helsinki area. The website offers extensive content including business categories, user reviews, and search capabilities for local services. It targets consumers seeking trusted local business information and provides business owners with advertising and management tools. The platform is built on modern web technologies including React and is hosted on Amazon AWS infrastructure with CDN support. While the site demonstrates strong content quality, branding consistency, and good privacy compliance with GDPR, it suffers from an invalid SSL certificate and lacks support for modern TLS protocols, which impacts its security posture. Security headers and content security policies are implemented, but some CSP directives allow unsafe inline scripts, which could be improved. Overall, the site is professional and trustworthy but should address SSL and TLS issues to enhance security and user trust.

Y

Yelp

yelp.com.au

73

Yelp is a well-established enterprise-level online platform specializing in local business reviews and recommendations, targeting consumers seeking trusted information about restaurants, services, and entertainment. The website leverages modern React technology and is hosted on a robust AWS CloudFront infrastructure, ensuring scalability and global reach. While the site demonstrates good content quality, clear navigation, and mobile optimization, the SSL certificate is currently invalid or missing, which poses a significant security risk. Security headers are properly configured, but enhancements such as OCSP stapling and session resumption are recommended. Privacy and cookie policies are present, though GDPR compliance is limited, reflecting the Australian market focus. Overall, Yelp maintains a strong business credibility and technical foundation but should prioritize resolving SSL issues and enhancing privacy compliance to improve trust and security posture.

L

LandHub

landhub.com

58

LandHub is a specialized real estate platform focusing on land, ranches, farms, and acreage properties primarily in the United States, with some listings in Canada and Mexico. The platform connects buyers and sellers through targeted marketing and new media strategies, offering services such as free buyer profiles and land selling assistance. The website demonstrates a moderate level of digital maturity, leveraging modern web technologies like React and Next.js, and integrates social media and tracking tools for marketing and analytics purposes. However, the site suffers from slow load times and lacks a valid SSL certificate, which critically impacts its security posture. The absence of HTTPS and security headers exposes users to potential risks and undermines trust. Privacy and cookie policies are present with consent mechanisms, but GDPR compliance is not clearly established. Contact information is limited to a contact form, with no explicit emails or phone numbers provided. Overall, while the business model and market positioning are clear and consistent, the technical and security shortcomings require urgent attention to improve user trust and compliance.

F

Flexport Inc

flexport.org

40

Flexport.org is a non-profit initiative under Flexport Inc that leverages logistics to facilitate global aid delivery and promote sustainability. The organization supports humanitarian relief efforts, discounted shipping for NGOs, and climate programs to reduce transport emissions. Their market position is strong within the humanitarian logistics sector, supported by partnerships with reputable NGOs and a clear mission to improve aid delivery efficiency. Technically, the website is built on modern frameworks like React and Gatsby, hosted on Amazon AWS, and employs advanced technologies such as Google reCAPTCHA and Mapbox GL JS. The site demonstrates good performance, mobile optimization, and accessibility, reflecting a mature digital infrastructure. Security posture is solid with HTTPS enforced using TLS 1.3 and strong cipher suites, absence of known vulnerabilities, and security headers that protect domain registration. However, improvements such as enabling HSTS, OCSP stapling, and DMARC records could enhance security further. Overall, the website is trustworthy, professional, and compliant with privacy regulations including GDPR. No blocking or WAF interference was detected, allowing full content access and analysis. Strategic recommendations include enhancing security headers and transparency measures to maintain and improve trust.

F

Flexport

deliverr.com

65

Flexport is a leading global supply chain logistics platform that integrates and coordinates logistics from factory to customer door. The company offers a comprehensive suite of services including ocean freight, air freight, trucking, customs brokerage, eCommerce fulfillment, and more. With a strong market presence and over 10,000 clients, Flexport leverages technology to provide real-time visibility and control over shipments, enabling businesses to optimize their supply chains and grow efficiently. The website demonstrates a high level of digital maturity, utilizing modern frameworks like React and Gatsby, and integrating advanced mapping and tracking technologies such as Mapbox. However, the security posture is currently weakened by the absence of a valid SSL certificate and lack of modern TLS protocols, which are critical for protecting data in transit. Privacy compliance is partially addressed with comprehensive privacy and terms of service pages, but lacks explicit cookie consent mechanisms. Overall, the site is professional and trustworthy, but should prioritize improving its SSL/TLS configuration to enhance security and user trust.

R

Railsware Solutions FZ-LLC

railsware.com

58

Railsware Solutions FZ-LLC operates as a mature and established product studio specializing in software development services and proprietary SaaS products such as Mailtrap.io, Coupler.io, and TitanApps.io. The company targets entrepreneurs and investors seeking technology partners, offering expertise in Ruby on Rails, React, mobile, fintech, and AI/ML consulting. Their market position is solidified by a mature domain age of 18 years and a consistent brand presence across multiple platforms. Technically, the website leverages modern JavaScript frameworks and analytics tools, hosted on AWS infrastructure, but suffers from slow load times and lacks a valid SSL certificate, which is a critical security flaw. Security posture is weak due to missing HTTPS, lack of security headers, and no HSTS implementation, despite good email authentication practices like DMARC with a reject policy. Privacy compliance is partial, with a comprehensive privacy policy but no visible cookie consent mechanism. Overall, the website is professional and trustworthy but requires urgent security improvements to protect user data and enhance trust.

L

Loopbear

loopbear.com

53

Loopbear is a technology company offering a powerful survey and feedback software platform designed to help businesses collect targeted, customizable user feedback to drive data-driven decisions. The company positions itself as privacy-friendly and GDPR compliant, emphasizing ease of integration and a broad set of features including advanced targeting, conditional logic, and extensive integrations with popular platforms like Zapier, Shopify, and Slack. The website demonstrates a modern technical infrastructure built on Next.js and React, with rich interactive content and animations. However, the absence of a valid SSL certificate and lack of critical security headers significantly weaken its security posture. While privacy claims are made, the lack of a cookie consent mechanism is a compliance gap. Overall, the business appears legitimate and consistent with its domain registration data, but it must address critical security issues to improve trust and compliance.

W

WP Spectra

wpspectra.com

67

WP Spectra is a technology company offering Spectra, a powerful and easy-to-use WordPress website builder designed for a wide range of users including web designers, developers, marketers, agencies, and SMBs. The company positions itself as a key player in the WordPress ecosystem with over 1 million users and strong integration with Brainstorm Force products. Their platform emphasizes no-code website creation, advanced customization, and AI-powered design assistance, enabling users to build fast, visually appealing, and SEO-optimized websites. Technically, the website is built on WordPress with modern frameworks like React and integrates various plugins and tools such as Presto Player and Ultimate Addons for Gutenberg. Despite a rich content offering and excellent design, the site lacks a valid SSL certificate and modern TLS support, which impacts its security posture. The site employs tracking and marketing tools like Google Tag Manager and ConvertBox, with moderate user tracking levels. Overall, the website is professional and trustworthy but should improve its SSL configuration and privacy compliance mechanisms to enhance security and user trust.