Medium-risk security reports

Baltic Rail AS is a medium-sized transportation company specializing in container-train operations and intermodal rail services primarily in the Baltic Adriatic Rail Corridor. Established in 2008 and owned by the Rail World Group, it operates container terminals and warehousing facilities in Estonia and Poland, serving key locations such as Wroclaw, Katowice, Ostrava, and Koper. The company targets businesses requiring efficient rail freight and logistics solutions in Central and Eastern Europe. The website reflects a professional and consistent brand image with clear service offerings and active news updates, indicating ongoing operations and market presence. Technically, the website is built on WordPress with a modern tech stack including Bootstrap and jQuery, and employs Google reCAPTCHA v3 for form security. The site is mobile-optimized and performs moderately well, with good SEO and accessibility basics. However, some security best practices such as security headers are missing, and no privacy or cookie policies are published, which impacts compliance. Security posture is generally good with HTTPS enforced and no visible vulnerabilities or exposed sensitive data. The absence of WHOIS data for the domain is a notable concern, as it conflicts with the business history claimed and may indicate domain registration issues. Overall, the site is trustworthy but would benefit from improved transparency and security documentation. Strategic recommendations include implementing security headers, publishing privacy and cookie policies, adding a vulnerability disclosure policy, and resolving WHOIS registration inconsistencies to enhance trust and compliance.

CYBERTEC PostgreSQL is a specialized technology company providing professional PostgreSQL services, support, training, and software products. The company targets enterprises and organizations seeking scalable and reliable PostgreSQL solutions, including migration, clustering, tuning, and consulting. Their market position is that of an established PostgreSQL expert with a comprehensive portfolio of services and products. The website is well-designed, mobile-optimized, and SEO-friendly, reflecting a mature digital presence. Technically, the site runs on WordPress with modern plugins and performance optimizations, ensuring fast loading and good accessibility. Security posture is strong with HTTPS, reCAPTCHA, and cookie consent mechanisms, although some security headers could be improved. The absence of WHOIS data reduces domain transparency and trustworthiness, but the website content and branding indicate a legitimate business. Overall, the risk is moderate with recommendations to enhance domain registration transparency and security headers.

The website unap.ro is currently inaccessible due to a firewall policy restriction, presenting an 'Access Denied' message with no accessible business content or contact information. The domain is registered since 2003 with a consistent registration history but lacks DNSSEC and detailed registrant information. Due to the blocking, no technical or business content can be analyzed, resulting in a low overall assessment score. The lack of privacy, cookie, and terms policies, as well as absence of contact details, further limits the evaluation. The website's security posture cannot be assessed beyond the indication of blocking, which suggests active security controls are in place but also restricts transparency. It is recommended to contact the site administrators or security team for further access or information.

Digient is a medium-sized Indian technology company specializing in B2B iGaming software, platforms, and solutions. With nearly two decades of experience, they provide customizable, scalable iGaming platforms, custom game development, hosting, payment integrations, and compliance services. Their website reflects a professional digital presence built on WordPress with modern plugins and SEO best practices. The company targets iGaming operators seeking fast and secure technology solutions to accelerate their market launch and growth. Technically, the website is well-structured, mobile-optimized, and uses HTTPS with a valid SSL certificate. However, it lacks explicit privacy and terms of service pages, and no security headers were detected, indicating room for improvement in security posture. Cookie consent is implemented, showing some privacy compliance awareness. Social media presence on Facebook, LinkedIn, and Twitter supports their business credibility. Overall, the site is functional and professional but could enhance trust and compliance by publishing comprehensive privacy, security, and incident response policies.

Luna Park Sydney is a well-established amusement and theme park located in Sydney, Australia, with a domain registered since 1999. The website offers comprehensive information about rides, ticketing options, immersive experiences, group bookings, and events, targeting families, tourists, and educational groups. The technical infrastructure is built on Adobe Experience Manager with integration of multiple modern analytics and marketing tools such as Google Analytics, Facebook Pixel, and TikTok Pixel. The site is mobile optimized and provides a good user experience with clear navigation and professional design. Security posture is solid with HTTPS enforced and CSRF protections, though explicit security headers and cookie consent mechanisms are lacking, which could be improved for better compliance and security. WHOIS data aligns well with the business claims, supporting legitimacy. Overall, the website scores well in content quality, technical implementation, and business credibility, with moderate privacy compliance and security posture scores.

addCar Rental operates an international online car rental service offering vehicle bookings across Europe, the USA, the Middle East, and other countries. The company targets travelers seeking affordable and reliable car rentals with services including airport pickup, insurance protection, flexible cancellations, and 24/7 support. The website reflects a medium-sized business with a consistent brand presence and recognition such as the 2024 booking.com Traveller Review Award. Technically, the site uses modern frameworks like Angular and Bootstrap, integrates Google Analytics and Tag Manager for tracking, and provides a responsive, well-structured user experience. Security posture is adequate with HTTPS enforced and cookie consent implemented, but lacks advanced security headers and explicit incident response information. The WHOIS data is missing or unavailable, which raises concerns about domain legitimacy despite the professional website and business presence. Overall, the site scores well on content quality and business credibility but should address WHOIS transparency and security header implementation to improve trust and compliance.

Levstal Group is a well-established Estonian company specializing in steel structures, metal engineering, and marine infrastructure services. With over three decades of experience, the company serves a broad European industrial client base, delivering high-quality fabrication and engineering solutions. Their business model focuses on B2B project-based contracts with a strong emphasis on quality and compliance, supported by multiple industry certifications. Technically, the website is built on WordPress with modern JavaScript libraries and analytics tools, demonstrating a mature digital presence with good SEO and mobile optimization. Security posture is solid with HTTPS enforced and clientTransferProhibited domain status, though improvements can be made by enabling DNSSEC and adding security headers. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, Levstal Group presents a professional, trustworthy, and technically sound online presence aligned with their business operations.

Birdeye Capital is a specialized alternative investment fund manager focusing on sustainable forestland investments. Established in 2013 and regulated by the Estonian Financial Supervision Authority, the company offers non-public, closed-ended funds tailored for institutional investors such as pension funds and family offices. Their business model emphasizes long-term sustainable growth and ESG compliance, positioning them as a trusted player in the Baltic investment market. Technically, the website is built on WordPress with modern plugins and libraries, providing a good user experience and mobile optimization. Security posture is solid with HTTPS and domain transfer protections, though lacking advanced security headers and explicit security policies. Privacy compliance is weak due to missing privacy and cookie policies. Overall, the website is professional and trustworthy but would benefit from enhanced privacy and security disclosures.

Citadele is a well-established banking institution operating in Estonia, providing a broad range of retail banking services including loans, deposits, insurance, and payment solutions tailored to individual customers. The website reflects a mature digital presence with comprehensive content, including loan calculators and detailed product offerings, targeting private banking customers. The company maintains a consistent brand image and integrates social media and partner links effectively. Technically, the site uses modern JavaScript libraries such as jQuery and Bootstrap, and is likely powered by OctoberCMS, ensuring a responsive and user-friendly experience. Security is robust with HTTPS enforced, secure cookie consent mechanisms, and standard security headers, although explicit security policies and incident response information are not publicly available. Overall, the site demonstrates good compliance with privacy regulations and provides clear contact information, supporting a trustworthy user experience.

The website onac-vg.fr is currently inaccessible due to a security mechanism that blocks all content, displaying only an 'Attack detected' message. This prevents any meaningful analysis of the site's business offerings, technical infrastructure, or security posture. The domain is registered with a French registrar since 2010, indicating an established presence, but no accessible content or contact information is available to verify the business details or services. The lack of metadata, forms, or external links further limits insight into the website's operations. Technically, the site shows no evidence of modern frameworks, CMS, or analytics tools due to the blocking. Security-wise, the absence of visible HTTPS or security headers and the presence of a generic blocking page suggest a protective WAF is in place, but no further security best practices can be confirmed. Overall, the site scores very low on content quality, technical implementation, security posture, privacy compliance, and business credibility due to the blocking. Strategic recommendations include enabling HTTPS, publishing clear privacy and cookie policies, providing contact and incident response information, and improving transparency to build trust.

The website is a domain sales landing page hosted on Sedo.com, offering the domain wineandspirit.eu for purchase. Sedo is a reputable domain marketplace platform with a long history since 1998, supported by a consistent WHOIS registration through World4You Internet Services GmbH. The site content is minimal, focusing solely on domain sale without additional business or contact information. Technically, the site uses modern web technologies including JavaScript modules and Cloudflare DNS, with HTTPS enabled and a cookie consent mechanism in place. However, there is no privacy policy, terms of service, or security policy published, which limits compliance and trust signals. Security posture is moderate with room for improvement in DNSSEC and security headers. Overall, the site serves its purpose as a domain sales page but lacks comprehensive business and compliance information.

Sustinere is a medium-sized ESG and sustainability advisory firm operating primarily in the Baltic region since 2016. The company offers a comprehensive suite of services including ESG strategy development, climate impact assessments, risk management, and digital solutions to support sustainability transformations. Their client base spans 11 sectors, indicating a broad market reach and trusted reputation. Technically, the website is built on WordPress with Elementor and Astra theme, leveraging modern web technologies and Google Tag Manager for analytics. The site is mobile-optimized and SEO-friendly, though accessibility features are basic. Security posture is strong with HTTPS, security headers, and no visible vulnerabilities, but lacks explicit privacy and incident response policies. Overall, the website reflects a professional and credible business with room for improvement in privacy compliance and transparency.

The website albayader.com is currently inaccessible due to a Cloudflare Turnstile security challenge that requires human verification before content can be accessed. This prevents any meaningful content analysis or business information extraction. The domain is registered since 2000 with GoDaddy and has standard domain protection statuses, indicating legitimate ownership. However, DNSSEC is not enabled, which is a minor security gap. No privacy, cookie, or terms of service policies are visible, nor are there any contact details or business descriptions available on the landing page. The site relies heavily on Cloudflare for security and performance. Due to the WAF challenge, the overall content quality, business credibility, and privacy compliance scores are very low, and the site cannot be fully assessed for SEO, accessibility, or user experience.

Sardina Systems is a technology company specializing in automated cloud-native infrastructure solutions leveraging OpenStack, Kubernetes, and Ceph. Their platform targets businesses seeking scalable, stable, and cost-effective cloud deployments. The website presents a professional and consistent brand image with good content quality and SEO optimization. Technically, the site is built on WordPress with modern cloud technologies referenced, and it employs HTTPS with strong SSL configuration. However, the absence of WHOIS registration data raises concerns about domain legitimacy. Security posture is moderate with HTTPS but lacks security headers and explicit privacy or cookie policies. Overall, the site is functional and professional but requires improvements in compliance and security transparency to enhance trust and reduce risk.

The website eplinc.com is currently inaccessible due to a Cloudflare error 1000 indicating that the DNS is pointing to a prohibited IP address. This misconfiguration prevents access to any business content or information, rendering the site effectively offline. The domain is registered with Network Solutions since 1995, indicating a longstanding registration, but the current DNS setup blocks user access. The site uses Cloudflare as a CDN and WAF, but the DNS conflict causes a security block. There is no visible privacy policy, cookie policy, terms of service, contact information, or business description available on the landing page. The lack of accessible content and policies severely limits the ability to assess the company’s business model, services, or compliance posture. From a security perspective, the site lacks visible security headers and does not provide incident response or vulnerability disclosure information. The overall security posture is weak due to the DNS misconfiguration and lack of transparency. The website’s technical infrastructure relies on Cloudflare but requires urgent DNS correction to restore accessibility and enable further analysis.

Vroon Group is a well-established international shipping company based in the Netherlands, specializing in vessel management and various shipping segments including offshore support, product tankers, and livestock carriers. The company maintains a professional and modern web presence with clear navigation and multimedia content to engage its target audience of shipping industry professionals and clients. The website demonstrates a good level of digital maturity with the use of modern JavaScript frameworks, video integration, and a comprehensive cookie consent mechanism compliant with GDPR standards. Security posture is strong, with HTTPS enforced and appropriate security headers in place, although explicit security and incident response policies are not publicly visible. Overall, the site reflects a trustworthy and credible business with room for improvement in transparency around terms of service and incident response. The domain registration data aligns well with the business claims, supporting legitimacy and trustworthiness.

BNI Eesti operates as the Estonian chapter of BNI, the world's leading business referral organization established globally in 1985. The website serves business professionals and entrepreneurs in Estonia, providing networking, referral generation, and business training services. The domain has been registered since 2010, aligning with the organization's established presence. The site uses a proprietary CMS and is hosted behind Cloudflare, leveraging modern web technologies including jQuery, Google Analytics, and Facebook Pixel for analytics and marketing. The website is well-structured, mobile-optimized, and presents consistent branding aligned with the global BNI identity. Security posture is good with HTTPS enforced and cookie consent implemented, though explicit security headers and detailed privacy/security policies are absent. Contact information is primarily via contact forms, with no direct emails or phone numbers visible. Overall, the site is professional, trustworthy, and serves its business networking purpose effectively.

Theptrgroup.com is a domain registered since 2000 with NameCheap, Inc. as the registrar and protected by Cloudflare DNS services. However, the website is currently inaccessible due to a Cloudflare 523 error indicating the origin server is unreachable. This prevents any content from being served to visitors, resulting in a lack of visible business information, contact details, or policies. The website title reflects the error state rather than business branding. The absence of content and metadata limits the ability to assess the company's market position, services, or target audience. Technically, the site uses Cloudflare as a CDN and DNS provider but lacks DNSSEC and security headers, which are recommended for improved security. The domain registration is consistent and long-standing, but the current unavailability severely impacts trust and credibility. Security posture is weak due to the origin server issue, and privacy compliance cannot be evaluated due to missing policies.

Splendid Asia Maldives is a well-established travel agency specializing in inbound travel services to the Maldives, offering a broad portfolio of luxury resorts, tours, flights, and holiday packages. Founded in 2006, the company enjoys a strong market position with a reputation for reliability, best rates, and expert local knowledge. The website reflects a professional and consistent brand image with good content quality and clear navigation tailored to leisure travelers and travel agents. Technically, the site is built on WordPress with modern plugins and integrates Google Tag Manager for analytics. Security posture is solid with HTTPS enforced and clientTransferProhibited domain status, though DNSSEC is not enabled and explicit privacy policies are missing. Cookie consent is implemented, indicating some privacy compliance efforts. Overall, the site is trustworthy and professionally maintained but would benefit from enhanced privacy documentation and security header improvements.

EIT Digital operates as Europe's largest digital innovation ecosystem, focusing on fostering a strong, inclusive, fair, and sustainable digital Europe. The organization facilitates collaboration among industry, academia, and startups to drive digital innovation, education, and entrepreneurship. Their market position is well established as a key player in the European technology sector, providing services that include ecosystem facilitation, education, and startup support. Technically, the website is built on TYPO3 CMS and integrates multiple modern marketing and analytics tools such as Google Tag Manager, Facebook Pixel, HubSpot, and Cookiebot for consent management. The site demonstrates good mobile optimization and SEO practices, although accessibility features are basic. Performance is moderate, with a well-structured and professional design. From a security perspective, the site enforces HTTPS and implements a comprehensive cookie consent mechanism. However, some security headers are not explicitly detected, and no privacy policy or terms of service pages were found in the provided content, which are areas for improvement. The WHOIS data is privacy protected, which is typical for organizations of this nature, and no suspicious patterns were identified. Overall, the website presents a professional and trustworthy digital presence with a strong business model and technical foundation. Strategic recommendations include enhancing privacy transparency, improving security header implementation, and providing clear contact information to bolster trust and compliance.

The International Transport Workers' Federation (ITF) operates a comprehensive website focused on its Africa regional activities, advocating for transport workers' rights and union coordination across the continent. The site demonstrates a mature digital presence with multilingual support, modern CMS technology (Drupal 10), and integration of analytics and translation services. Contact information is clearly provided with physical offices in Nairobi and Abidjan, supporting its global federation status. However, the absence of a visible privacy policy and terms of service pages, along with incomplete WHOIS data, slightly detracts from its overall trustworthiness. Security posture is adequate with HTTPS and anonymized analytics but lacks explicit security headers and vulnerability disclosure mechanisms. Overall, the website is professional, content-rich, and well-structured, serving its target audience effectively while leaving room for improvements in privacy and security transparency.

SmartCap is a state-owned Estonian fund manager established in 2011, operating under a license from the Estonian Financial Supervision Authority. It focuses on cornerstone investments in venture capital, green technology, and defence sectors to foster innovation and economic growth in Estonia. The company is a subsidiary of Foundation KredEx and targets private fund managers and innovative companies within Estonia. The website reflects a professional and consistent brand image with comprehensive content about its funds and investment focus. Technically, the site is built on WordPress with modern performance optimizations and cookie consent management, ensuring good user experience and compliance with privacy regulations. Security posture is strong with HTTPS and no visible vulnerabilities, though some security headers and policies could be improved. Overall, the website is trustworthy, well-structured, and compliant with GDPR requirements.

Miltton is an established consultancy firm founded in 2007, specializing in business, communications, and design consultancy services. The company targets organizations seeking impactful change through strategic insights, creative communications, and design thinking. Their market position is strengthened by a diverse team and international presence with subsidiaries or related sites in Europe, Finland, Sweden, Ukraine, and the USA. The website reflects a professional and modern digital presence, leveraging WordPress CMS with advanced SEO and analytics integrations such as Yoast SEO, Google Tag Manager, and Matomo. Cookie consent mechanisms and a comprehensive privacy policy demonstrate GDPR compliance and a commitment to user privacy. Security posture is solid with HTTPS enabled and no visible vulnerabilities, though improvements could be made by enabling DNSSEC and adding security headers. Overall, the domain registration data aligns well with the business claims, supporting legitimacy and trustworthiness.

Lappset Group is a global manufacturer and supplier specializing in playground equipment, outdoor exercise equipment, park furniture, and interactive sports equipment. The company targets diverse markets including schools, public spaces, private yards, sports facilities, healthcare, and leisure sectors. Their business model includes manufacturing, custom solutions, and lifecycle services such as installation, maintenance, and recycling. The website reflects a well-established brand with comprehensive product and service offerings, supported by certifications like Environmental Product Declarations (EPDs). Technically, the website is built on modern frameworks such as Vue.js and Tailwind CSS, with good mobile optimization and SEO practices. Security posture is solid with HTTPS enforced and cookie consent mechanisms in place, though some security headers and explicit policies could be improved. The absence of WHOIS data is a notable anomaly but does not detract significantly from the overall legitimacy given the professional web presence. Strategic recommendations include enhancing security headers, publishing a security policy, and adding vulnerability disclosure information to strengthen trust and compliance.

Efore is a company specializing in automated battery cell manufacturing and energy storage solutions, targeting industrial, telecom, and energy sectors. Their website presents a professional image with clear navigation and modern design, leveraging WordPress and Elementor technologies. The company emphasizes customized battery solutions and sustainability. Technically, the site is well-structured with SEO optimization and mobile responsiveness, though performance is moderate. Security posture is adequate with HTTPS enabled and no visible vulnerabilities, but lacks advanced security headers and explicit security policies. Privacy compliance is limited, with no clear privacy or terms of service pages, though a cookie consent mechanism is present. WHOIS data is missing, which raises concerns about domain registration legitimacy. Overall, the site is functional and professional but would benefit from enhanced transparency and security documentation.

Fleet Complete Eesti operates as a regional provider of fleet and mobile workforce management solutions in Estonia, targeting businesses that require vehicle and workforce tracking and management. The website is built on WordPress using the Divi theme and incorporates common marketing and analytics tools such as Google Tag Manager and Facebook Pixel. The technical infrastructure appears to be hosted on AWS, as indicated by the DNS servers. However, the website lacks visible privacy and cookie policies, terms of service, and contact information, which impacts its privacy compliance and business credibility. Security posture is basic with no detected security headers or advanced protections. The domain registration is consistent and legitimate, supporting the business's claimed history since 2017.