Medium-risk security reports

Odibets is a Kenyan online sports betting and casino platform operated by Kareco Holdings Limited. Established in 2018, it offers a variety of betting services including sports betting, live betting, casino games, jackpots, and fantasy sports under the OdiLeague brand. The platform targets sports bettors primarily in Kenya but also covers international soccer and other sports. The website promotes a lightweight 2MB mobile app and provides multiple betting options with a focus on soccer and basketball. The business is licensed and regulated by the Betting Control and Licensing Board of Kenya, indicating compliance with local gambling regulations. Technically, the website uses modern JavaScript frameworks such as Vue.js and integrates multiple third-party services including Google Analytics, Microsoft Clarity, Sportradar widgets, and OneSignal for push notifications. The site is mobile optimized and has good SEO practices with comprehensive meta tags and Open Graph data. Hosting details are not explicit but DNS is managed via Cloudflare, and the domain is registered with GoDaddy with a long-term expiry. From a security perspective, the site enforces HTTPS and has domain status protections to prevent unauthorized changes. However, it lacks DNSSEC, explicit security headers, and published security or incident response policies. There is no visible cookie consent mechanism, which may impact privacy compliance. The site uses extensive tracking and advertising scripts, indicating a moderate to extensive user tracking level. Overall, Odibets presents as a legitimate, professional online betting platform with a solid business foundation and good technical implementation. Security posture is adequate but could be improved by adding DNSSEC, security headers, and formal security policies. Privacy compliance should be enhanced by implementing cookie consent and clearer data protection disclosures.

Baker Hughes is a leading energy technology company focused on advancing energy solutions that are safer, cleaner, and more efficient. The company offers a broad portfolio of services and technologies including energy transition, hydrogen technologies, carbon capture, emissions abatement, and AI-driven energy operations. Positioned as a large enterprise in the energy sector, Baker Hughes targets industry professionals, investors, and customers seeking innovative energy solutions. The website reflects a mature digital presence with comprehensive content, clear navigation, and strong branding. Technically, the website is built on Drupal CMS and integrates modern technologies such as Google Tag Manager and OneTrust for privacy compliance. The site is mobile-optimized, accessible, and SEO-friendly, indicating a well-maintained technical infrastructure. Security posture is strong with HTTPS enforced, security headers present, and no exposed sensitive data detected. However, explicit security policies and incident response information are not published, which could be improved. Overall, the security and privacy compliance are good, with clear privacy and cookie policies and consent mechanisms in place. The absence of WHOIS data is a notable gap but does not detract significantly from the site's legitimacy given the professional presentation and verified contact information. Strategic recommendations include publishing security policies, adding vulnerability disclosure information, and enhancing transparency around data protection roles. This analysis suggests Baker Hughes maintains a robust online presence aligned with its enterprise stature, though there are opportunities to enhance security transparency and compliance documentation.

The website www.carriere-iam.ma serves as a login portal for Maroc Telecom's career services, targeting job seekers and employees within the telecommunications sector in Morocco. The site features a professional design consistent with Maroc Telecom's branding and integrates modern authentication mechanisms including LinkedIn OAuth and Google reCAPTCHA v3 to enhance security. The technical infrastructure leverages contemporary web technologies such as Google Tag Manager, Google Analytics, and Trend Micro security scripts, hosted likely behind Cloudflare services, ensuring reliable performance and security. Security posture is strong with HTTPS enforced, CSRF protection, and secure password input fields, although explicit security headers are not detected. Privacy compliance is partial, with a functional cookie consent banner but no visible privacy policy or terms of service pages. WHOIS data is incomplete, lacking registrar and registrant details, which slightly impacts trust but does not outweigh the professional presentation and security features. Overall, the site is well-constructed for its purpose but would benefit from enhanced transparency and compliance documentation.

Paramount+ is a leading global streaming service operated by Paramount Global, offering a wide range of live TV, movies, original programming, and news content. The platform targets general consumers seeking entertainment across multiple devices with a subscription-based model. The website demonstrates a mature digital infrastructure with modern JavaScript frameworks, integration of advanced security features such as Google reCAPTCHA Enterprise, and compliance with privacy regulations including GDPR. The presence of OneTrust cookie consent and comprehensive privacy and terms of service pages further reinforce its commitment to user privacy and regulatory compliance. Security posture is strong with HTTPS enforcement, security headers, and fraud protection in payment processing. However, the absence of publicly available WHOIS data introduces a minor trust gap, likely due to privacy protections or registry policies. Overall, the site is professional, secure, and user-friendly, reflecting the stature of a major media enterprise.

Pluto TV is a leading free streaming television service offering over 250 live channels and thousands of on-demand movies and TV shows. Owned by Pluto Inc., a subsidiary of Paramount Global, it targets a broad consumer base seeking free, ad-supported streaming content across multiple platforms including smart TVs, mobile devices, and web browsers. The website demonstrates a mature digital presence with comprehensive content, consistent branding, and extensive platform support. Technically, the site uses modern frameworks such as React and integrates industry-standard analytics and marketing tools like Google Analytics and Facebook Pixel. Security posture is good with HTTPS enforced and no visible vulnerabilities, though some security headers could be improved. Privacy compliance is strong with clear policies and consent mechanisms in place. Overall, the site is professional, trustworthy, and well-optimized for user experience and SEO.

The website hendersoncountync.gov appears to be a government domain likely representing Henderson County, North Carolina. However, the actual website content is inaccessible due to a Cloudflare Web Application Firewall (WAF) block, which prevents any meaningful content or metadata extraction. The domain is registered with get.gov, a registrar commonly used for government domains, and the domain age (since 2016) aligns with a legitimate government entity. The blocking page indicates triggered security rules, possibly due to automated scanning or suspicious request patterns. Without access to the actual site content, no privacy policies, contact information, or business details can be confirmed. Technically, the site is protected by Cloudflare services, including DNS and security layers, which is a positive indicator for security posture but also limits external analysis. No security headers or SSL configuration details are available from the provided data. The lack of visible content and metadata results in a very low AI score, reflecting the inability to assess the site comprehensively. From a security perspective, the presence of Cloudflare WAF is a strength, but the blocking also hinders transparency and external trust evaluation. The domain WHOIS data is privacy protected but consistent with government domain registration practices. Overall, the site appears legitimate but inaccessible for detailed analysis, requiring direct access or cooperation from site administrators for further assessment.

OutSystems is a leading enterprise low-code platform provider that integrates AI capabilities to accelerate custom application development. Positioned as a Forrester Wave Leader for 2025, the company targets professional developers and enterprises seeking scalable, intelligent software solutions. Their platform offers full-stack development, pre-built integrations, automated testing, DevOps, and cloud-native architecture, enabling digital transformation with existing teams. Technically, the website demonstrates a mature digital infrastructure with modern frameworks, extensive analytics, and strong mobile optimization. Security posture is robust with HTTPS enforcement, security headers, and privacy-conscious tracking, although explicit incident response and vulnerability disclosure policies are not publicly visible. Overall, the website reflects a professional, trustworthy, and technically advanced organization with a strong market presence in the technology sector.

Etihad Airways operates as a major international airline headquartered in the United Arab Emirates, offering premium passenger flight services globally. The website serves as a comprehensive platform for booking flights, managing reservations, and accessing loyalty programs. The digital infrastructure leverages modern web technologies including React and Adobe Experience Manager, supported by robust analytics and marketing tools such as Google Tag Manager and Facebook Pixel. The site demonstrates strong mobile optimization and accessibility features, ensuring a high-quality user experience. Security posture is solid with HTTPS enforcement, security headers, and cookie consent mechanisms, although explicit security policy and incident response information are not publicly disclosed. The absence of WHOIS data is noted but likely due to privacy or registry policies rather than suspicious activity. Overall, the website reflects a mature digital presence consistent with a large enterprise airline brand.

Bstadium.es operates as a specialized online marketplace offering sports and leisure experiences primarily linked to football clubs in Spain. The platform combines ticket sales for football matches, stadium tours, and other related activities such as tourism and gastronomy, targeting sports enthusiasts and tourists interested in unique football-related experiences. The website demonstrates a consistent brand presence with clear navigation and a professional design, supporting a small-sized business model focused on niche e-commerce within the sports sector. Technically, the website employs modern web standards including HTML5, CSS3, JavaScript, and uses libraries such as HTMX and FontAwesome. It is mobile-optimized and includes structured data for SEO enhancement. Performance is moderate with good mobile responsiveness and basic accessibility features. However, some improvements in accessibility and security headers could enhance the technical maturity. From a security perspective, the site enforces HTTPS and uses CSRF tokens in forms, indicating a baseline security posture. No explicit security headers were detected, and no vulnerability disclosures or incident response contacts are published. Privacy compliance is partially addressed through a cookie consent banner, but lacks a visible privacy policy or terms of service, which are critical for GDPR compliance and user trust. Overall, the website presents a moderate risk profile with no critical security issues detected but with room for improvement in privacy compliance and security best practices. Strategic recommendations include publishing comprehensive privacy and security policies, implementing security headers, and enhancing accessibility to improve trust and compliance.

Fullmakt.nu is a Swedish website operated by Svenska Försäkringsfabriken, providing services related to power of attorney matters. The site is minimalistic, offering basic information and a contact email for support. The business appears to be a small, niche service provider focused on legal and insurance-related assistance in Sweden. The domain is well-established, registered since 2007, and hosted by a reputable Swedish registrar, Loopia AB. Technically, the website is simple, with no advanced frameworks or CMS detected, and limited optimization for mobile or SEO. Security posture is basic, with no DNSSEC enabled and no security headers present, indicating room for improvement. Privacy and cookie policies are absent, which impacts compliance with GDPR and related regulations. Overall, the site is functional but lacks depth in content, security, and privacy features.

Arqus European University Alliance is a collaborative academic consortium uniting nine European research universities to foster education, research, and cultural exchange. The alliance targets researchers, administrative staff, stakeholders, citizens, and students, offering joint master's programs, research initiatives, and innovation funds. The website reflects a mature digital presence with WordPress CMS, Elementor framework, and integration of modern web technologies such as jQuery, Slick Carousel, and Google Tag Manager. Security posture is solid with HTTPS enforcement and cookie consent mechanisms, though explicit security policies and vulnerability disclosures are absent. Overall, the site is professional, trustworthy, and well-optimized for SEO and mobile devices.

UniversiDATA is a specialized open data portal focused on the higher education sector in Spain, aggregating datasets from multiple universities to promote transparency and data reuse. The platform offers a catalog of datasets, analytical applications, and news updates, targeting universities, researchers, and data reusers. The website is built on Drupal 7 with modern front-end technologies and integrates Google Analytics with privacy-conscious configurations. Security posture is solid with HTTPS and cookie consent mechanisms, though there is room for improvement in security headers and explicit security policies. Overall, the site is professional, trustworthy, and well-positioned within its niche.

CRUE (Conferencia de Rectores de las Universidades Españolas) is a prominent non-profit organization representing Spanish universities. The website serves as a central hub for information about the organization’s governance, activities, policies, and events, targeting academic institutions, students, researchers, and education stakeholders in Spain. It offers comprehensive resources including agendas, publications, and institutional representation. The organization holds a leading market position within the Spanish higher education sector. Technically, the website is built on WordPress with a modern plugin ecosystem including GDPR compliance tools, event management, and multimedia integration. The site demonstrates good mobile optimization, accessibility, and SEO practices, supported by structured data and social media integration. Performance is moderate with room for optimization. From a security perspective, the site enforces HTTPS and employs cookie consent mechanisms, reflecting compliance with GDPR. While explicit security headers are not fully visible in the HTML, the use of security/privacy plugins and absence of exposed sensitive data indicate a solid security posture. No critical vulnerabilities or suspicious WHOIS patterns were detected, though WHOIS data is privacy protected, which is typical for such organizations. Overall, CRUE’s website is professional, trustworthy, and well-aligned with its mission. Strategic recommendations include enhancing security headers, publishing explicit security policies, and enabling DNSSEC to further strengthen domain security.

Soa Aids Nederland is a reputable Dutch non-profit organization dedicated to preventing, detecting, and treating HIV and other sexually transmitted infections. The website serves both the general public and healthcare professionals, offering comprehensive information, testing guidance, and professional tools. It is well-positioned in the Dutch healthcare sector with strong partnerships and a clear mission. The digital infrastructure is modern, leveraging Drupal 10 CMS and integrating advanced analytics and user engagement tools while maintaining GDPR compliance through explicit cookie consent mechanisms. Security posture is strong with HTTPS enforcement and secure data handling practices, though some security headers could be explicitly confirmed. Overall, the website demonstrates high professionalism, trustworthiness, and user-centric design.

ePayco is a Colombian payment gateway platform offering a variety of payment solutions including online payments, point-of-sale transactions, subscription management, fraud mitigation, and e-commerce shops. The company targets businesses and merchants in Colombia, providing secure and agile technology to facilitate payments and collections. The website is built on WordPress with Elementor and integrates multiple analytics and tracking tools such as Google Analytics, Facebook Pixel, and TikTok Pixel, indicating a mature digital marketing strategy. Security posture is solid with HTTPS enforced and domain registration locked with multiple EPP status flags, although DNSSEC is not enabled and no explicit security or privacy policies are published. The domain is well-established since 2009, consistent with the company's market presence. Overall, the website is professional, well-branded, and technically sound but lacks some compliance documentation and explicit security disclosures.

CRMInbox is a Mexico-based technology company founded in 2023, specializing in WhatsApp CRM solutions including multi-agent management, mass messaging, and chatbot integration for ISPs. The website is professionally designed with clear navigation, detailed pricing, and FAQ sections targeting businesses seeking efficient WhatsApp communication tools. Technically, the site uses modern frameworks like Bootstrap and jQuery, integrates Google Tag Manager and Smartsupp live chat, and is hosted with Cloudflare DNS and registrar services. Security posture is moderate with HTTPS enabled but lacks advanced security headers and cookie consent mechanisms. Privacy policies and terms of service are present but GDPR compliance is limited. Overall, the site demonstrates a credible business presence with room for improvement in security and privacy compliance.

SIA Transact Pro is a licensed electronic money institution based in Latvia, operating since 2004. It provides comprehensive payment services including card issuing, payment processing, and gateway services primarily targeting corporate clients and merchants. The company is a principal member of major payment networks such as Visa and Mastercard and is affiliated with Transact Bank N.A. The website reflects a mature business with clear service offerings and regulatory compliance. Technically, the site uses modern analytics and security tools, including Google Tag Manager, Google Analytics, and reCAPTCHA, and enforces HTTPS with PCI DSS Level 1 compliance. However, it lacks publicly available privacy and security policies, incident response contacts, and vulnerability disclosure mechanisms, which are important for transparency and trust in the financial sector. Overall, the website is professional, secure, and trustworthy, with room for improvement in privacy compliance and security communication.

SIA Transact Pro is a Latvia-based licensed electronic money institution established in 2004, providing comprehensive payment services including card issuing, payment processing, and gateway services. It holds principal memberships with Visa and Mastercard and operates under the supervision of the Bank of Latvia. The company targets corporate clients, e-commerce businesses, and financial institutions, offering tailored payment solutions and card products such as debit, credit, prepaid, gift, loyalty, and virtual cards. The business is affiliated with Transact Bank N.A., enhancing its banking and financial service capabilities. Technically, the website employs modern JavaScript libraries and integrates Google Tag Manager, Google Analytics, and Yandex Metrica for analytics and user tracking. The site is mobile-optimized with good navigation and professional design. Security measures include HTTPS enforcement, PCI level 1 compliance claims, and use of Google reCAPTCHA for form protection. However, explicit security policies and incident response information are not published, representing an area for improvement. The security posture is strong with no visible vulnerabilities or exposed sensitive data. Privacy compliance is moderate due to the presence of a cookie policy and consent mechanism but lacks a dedicated privacy policy page. Contact information is clearly provided with multiple channels including phone, email, and physical address. Overall, the website and business demonstrate high trustworthiness and professionalism. Strategically, the company should focus on publishing comprehensive privacy and security policies, enhancing accessibility, and formalizing incident response and vulnerability disclosure processes to strengthen compliance and customer trust.

The Universidad Autónoma de Madrid (UAM) is a prominent public university in Spain, offering a wide range of undergraduate, postgraduate, and research programs. It holds a strong market position as one of Spain's leading universities, ranked 206 worldwide in the QS World University Rankings 2026. The institution targets students, researchers, academic staff, and prospective students, providing education, research, innovation, and cultural services. The website reflects a mature digital presence with comprehensive content, clear navigation, and multilingual support. Technically, the website employs modern web technologies including Google Tag Manager and Google Analytics for tracking, with good mobile optimization and accessibility features. The site uses HTTPS with strong SSL configuration, though it lacks some advanced security headers. No CMS or hosting provider details were explicitly detected. Performance is moderate, with room for optimization. Security posture is solid with no visible vulnerabilities or exposed sensitive data. However, the absence of a published security policy, incident response contacts, or vulnerability disclosure mechanisms suggests areas for improvement. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms, aligned with GDPR requirements. Overall, the website is professional, trustworthy, and well-maintained, supporting the university's reputation. The WHOIS data is restricted by the Spanish registry policy, which is typical and does not detract from legitimacy. Strategic recommendations include enhancing security headers, publishing security policies, and implementing vulnerability disclosure practices to further strengthen trust and security.

RAV Flevoland RAV Gooi en Vechtstreek operates as a regional ambulance service provider in the Netherlands, focusing on emergency medical care and patient transport within the Flevoland and Gooi en Vechtstreek regions. The website serves as an information portal for residents and healthcare professionals, offering details about ambulance services, locations, news, and contact options. The organization positions itself as a key regional healthcare service with a public service business model. Technically, the website is built on WordPress with modern plugins such as Yoast SEO and integrates Google services including Analytics, Tag Manager, and reCAPTCHA for security and tracking. The site is mobile-optimized and demonstrates good SEO practices, although some accessibility features could be enhanced. Hosting appears to leverage Cloudflare for CDN and performance improvements. From a security perspective, the site enforces HTTPS and uses reCAPTCHA to protect forms, but lacks several important security headers that could improve defense against common web attacks. No critical vulnerabilities or exposed sensitive data were detected. Privacy compliance is partially addressed with a privacy policy present, but no explicit cookie consent mechanism was found, which is a gap for GDPR compliance. Overall, the website is professional, trustworthy, and well-maintained, with a solid business credibility score. Recommendations include enhancing security headers, implementing cookie consent, and publishing explicit security and incident response policies to strengthen compliance and security posture.

ShanghaiRanking is a website dedicated to providing university rankings and academic evaluation services. It targets academic institutions, researchers, students, and education policymakers. The site uses modern web technologies such as Vue.js and Nuxt.js, and integrates analytics tools like Google Analytics and Google Tag Manager to monitor user interactions. The website design is professional with good navigation and content relevance, although mobile optimization and accessibility are basic. Security posture is moderate but lacks visible security headers and explicit privacy or cookie policies, which are important for compliance and user trust. The absence of WHOIS data raises concerns about domain legitimacy and ownership transparency, impacting overall business credibility. Strategic improvements in security headers, privacy compliance, and domain registration transparency are recommended to enhance trust and security.

Fundación ICO is a Spanish non-profit foundation affiliated with the Instituto de Crédito Oficial (ICO), focusing on promoting cultural activities, financial education, and sustainable economic development. The website serves as a portal for information on their educational programs, art exhibitions, publications, and institutional collaborations. It targets a broad audience including educators, students, professionals in finance, and the general public interested in sustainability and culture. The foundation holds a recognized position in Spain's public and cultural sectors, leveraging its connection to ICO to deliver impactful programs and resources. Technically, the website is built on the Liferay CMS platform with custom theming and uses a mix of legacy and modern JavaScript libraries including jQuery and Google Tag Manager for analytics and marketing. The site is mobile optimized with good navigation and SEO practices, though some accessibility features are basic. Performance is moderate, with room for improvement in modernizing the tech stack and enhancing accessibility. From a security perspective, the site enforces HTTPS and implements cookie consent mechanisms compliant with GDPR and Spanish regulations. However, it lacks visible security headers and explicit security or incident response policies. No critical vulnerabilities or exposed sensitive data were detected. Analytics usage is moderate, primarily through Google services, with a reasonable privacy compliance posture. Overall, Fundación ICO's website is professional, trustworthy, and aligned with its public foundation status. Strategic improvements in security headers, updated libraries, and enhanced transparency on security policies would further strengthen its posture and user trust.

BME Bolsas y Mercados Españoles is the leading operator of financial markets in Spain, providing a comprehensive range of services including stock exchange operations, securities clearing and settlement, market data, and financial education. The website reflects a mature digital presence with a professional design, clear navigation, and multilingual support. Technically, the site is built on Adobe Experience Manager, uses modern tracking and consent management tools, and implements HTTPS with appropriate security headers, indicating a solid security posture. However, the absence of publicly accessible WHOIS data and lack of explicit security policies or incident response contacts suggest areas for improvement in transparency and security communication. Overall, the site is trustworthy and well-positioned in the finance sector, serving investors, issuers, and financial institutions effectively.