Medium-risk security reports

The website oneq.tech is a newly registered domain primarily serving as a parked domain with minimal content focused on advertising and related search results. There is no clear business description, contact information, or services presented, indicating it is not an active commercial or service website. The technical infrastructure relies on Cloudflare DNS and Google advertising scripts, with basic HTML and CSS but lacks advanced frameworks or CMS. Security posture is moderate with HTTPS enabled but missing important security headers and DNSSEC. Privacy compliance is minimal with a basic privacy policy but no cookie consent mechanism or GDPR indicators. Overall, the site has low trustworthiness and limited business credibility.

EIVA a/s is a well-established engineering company specializing in software and hardware solutions for maritime survey, offshore, and shallow water construction industries. With over 45 years of experience, EIVA offers a comprehensive portfolio including software products, equipment sales and rental, integrated system solutions, 24/7 support, and professional training services. Their market position is strong, supported by a professional website, active social media presence, and a broad customer base in the energy and transportation sectors. Technically, the website employs modern web technologies such as Google Tag Manager, Cookiebot for consent management, and lazy loading for performance optimization. The site is mobile-optimized, accessible, and SEO-friendly, reflecting a mature digital infrastructure. Security-wise, the site enforces HTTPS and uses secure forms but lacks explicit security headers and a public security policy or incident response information, which are areas for improvement. The absence of WHOIS data for the domain is a notable anomaly, slightly reducing trust in domain registration transparency, though the overall business credibility remains high. Strategic recommendations include publishing a dedicated security policy, enhancing security headers, and providing incident response contacts to strengthen trust and compliance.

CareMatch is a Dutch healthcare intermediary company that has operated since 2005, specializing in connecting independent healthcare professionals with care organizations and private clients. The company has a strong market presence in the Netherlands with over 18 years of experience and a network of more than 1,100 healthcare professionals. Recently, due to regulatory changes concerning the Wet DBA and increased enforcement by the Dutch Tax Authority, CareMatch has decided to permanently cease its services by April 1, 2025, transitioning ongoing care requests to a partner company, Gewoon Professionals. The website clearly communicates this transition and provides comprehensive FAQs to assist clients, care providers, and organizations during the wind-down period.

The domain www.scansource.com is not found in the WHOIS registry, indicating it is either unregistered, expired, or inactive. The website content is minimal or blocked, preventing extraction of meaningful business or technical information. No privacy, cookie, or terms of service policies are detected, nor are there any contact details or security policies available. The lack of WHOIS data and website content suggests the domain is not currently operational or legitimate. Consequently, a comprehensive security and compliance analysis cannot be performed.

AffaldPlus is a publicly owned waste management company serving six municipalities in Denmark, focusing on waste reception, treatment, recycling, and energy production. The website is built on Drupal 10 and uses modern web technologies to provide a good user experience with clear navigation for both citizens and businesses. Contact information is comprehensive and includes email, phone, physical address, and newsletter subscription. Social media presence on LinkedIn and Facebook supports community engagement. Security posture is adequate with HTTPS enabled and secure forms, but lacks some security headers and explicit security policies. Privacy compliance is partial with a privacy policy present but no cookie consent mechanism detected. Overall, the website is professional, trustworthy, and well-aligned with the business it represents.

JVL A/S is a Danish company specializing in integrated stepper and servo motors, offering innovative modular interfaces including Industrial Ethernet solutions. The company positions itself as a leader in the motion control technology sector, targeting industrial and automation markets. The website reflects a professional business presence with clear descriptions of products and services, although explicit contact details and comprehensive corporate information are limited on the public site. Technically, the website employs a proprietary SEO & CMS system by Media2 Online, leveraging technologies such as jQuery, Jssor Slider, and Cookiebot for cookie consent management. Google Analytics is used for visitor tracking, indicating a moderate level of digital maturity. The site is moderately optimized for performance and mobile devices but could benefit from enhanced accessibility and security header implementations. From a security perspective, the site uses HTTPS and implements a cookie consent mechanism compliant with GDPR. However, no explicit security policies or incident response contacts are publicly available. The absence of WHOIS data due to privacy protection is typical for commercial entities in Denmark and does not raise immediate concerns. Overall, the security posture is adequate but could be improved with additional transparency and technical hardening. The overall risk assessment suggests a legitimate and professionally managed website with room for improvement in security best practices and corporate transparency. Strategic recommendations include enhancing security headers, publishing security and incident response policies, improving mobile and accessibility features, and maintaining compliance documentation to strengthen trust and resilience.

Salonsupport A/S operates a professional B2B e-commerce platform serving Denmark's hairdressing industry, offering a wide range of hair care products, accessories, and stylist education. Established in 2004, it holds a strong market position as one of the largest suppliers in its sector. The website is built on modern web technologies including Nuxt.js and Tailwind CSS, providing a responsive and user-friendly experience. Marketing and tracking are managed via Klaviyo, indicating a focus on customer engagement. Security posture is adequate with HTTPS enabled, but lacks advanced security headers and explicit security policies. Privacy compliance is partial, with a privacy policy present but no cookie consent mechanism detected. Overall, the site is professional and trustworthy but could improve in security and privacy transparency.

Iterator IT is a Danish technology company specializing in custom IoT solutions and business-driven software development. Founded in 2016, the company focuses on digitalizing production processes, optimizing business operations, and creating data-driven value for its clients. Their services include IoT consulting, sensor integration, cloud data collection, and application development, targeting businesses seeking tailored technology solutions. The website reflects a professional and consistent brand image with a clear focus on technology and innovation in the IoT space. Technically, the website is built on WordPress using a modern and feature-rich theme (Brooklyn) and incorporates numerous JavaScript libraries for enhanced user experience. It employs Google Analytics and Tag Manager for visitor tracking and includes a cookie consent mechanism compliant with GDPR requirements. The site is mobile-optimized and SEO-friendly, though accessibility features are basic. Hosting and domain registration are consistent with the company's Danish origin. From a security perspective, the website enforces HTTPS with a valid SSL certificate and uses cookie consent banners to manage user privacy. However, it lacks DNSSEC for DNS security and does not implement advanced security headers, which could be improved. No critical vulnerabilities or exposed sensitive data were detected. The absence of a privacy policy and terms of service pages is a compliance gap that should be addressed. Overall, Iterator IT presents a credible and professional online presence with a solid technical foundation and moderate security posture. Strategic improvements in privacy documentation and security headers would enhance compliance and trustworthiness.

The website dohlmann.eu is currently non-functional, displaying a database connection error page with no accessible content or metadata. This prevents any meaningful analysis of the business, services, or security posture from the website itself. The domain is registered through a reputable registrar, One.com A/S, indicating legitimate domain ownership, but the lack of operational website content severely limits trust and credibility. The technical infrastructure appears to have critical backend issues that must be resolved to restore service. Security posture is weak due to absence of HTTPS and security headers, and no privacy or cookie policies are present. Overall, the site is currently at high risk due to unavailability and lack of security controls.

Den Sociale Retshjælps Fond is a Danish non-profit organization dedicated to providing free legal aid and debt counseling services across Denmark. The website clearly targets Danish citizens seeking assistance with legal and financial issues, positioning itself as a trusted social aid foundation. The business model revolves around offering free advisory services, supported by a consistent brand presence and active social media engagement. The website's content is relevant and professionally presented, supporting its mission effectively. Technically, the website is built on WordPress using a modern stack including Elementor for design, Yoast SEO for optimization, and Cookiebot for cookie consent management. Hosting appears to be provided by One.com, and the site demonstrates moderate performance with good mobile optimization. Accessibility features are basic but present, and SEO practices are well implemented. From a security perspective, the site employs HTTPS and includes a cookie consent mechanism, enhancing privacy compliance. The presence of security plugins like Stop User Enumeration indicates awareness of security best practices. However, the absence of explicit security headers and a privacy policy page suggests room for improvement. No vulnerabilities or exposed sensitive data were detected in the analyzed content. Overall, the website presents a solid risk profile with a good security posture and trustworthy business legitimacy. Strategic recommendations include adding comprehensive privacy and terms of service pages, enhancing security headers, and publishing a vulnerability disclosure policy to further strengthen compliance and trust.

MERQUR is a Danish service provider specializing in accounting, administration, bookkeeping, and consulting services. The company positions itself as a quality-focused provider delivering careful craftsmanship at competitive pricing. The website is built on WordPress using the Enfold theme and includes modern analytics tools such as Google Analytics and Matomo, indicating a moderate level of digital maturity. The site is mobile optimized and provides a cookie consent mechanism with detailed user controls, reflecting awareness of privacy compliance requirements. However, explicit privacy policies, terms of service, and contact information are not present in the analyzed content, which may impact user trust and compliance completeness. Security posture is generally good with HTTPS enforced and no visible vulnerabilities, but lacks advanced security headers and incident response information.

Fibertex Nonwovens A/S is a well-established manufacturer specializing in nonwoven and performance materials serving diverse industrial sectors such as automotive, construction, filtration, and healthcare. With over 50 years of industry experience and a global footprint including multiple subsidiaries, Fibertex positions itself as a leader in delivering high-performance, sustainable solutions. The company targets industrial clients requiring specialized materials and emphasizes innovation and partnership in its business approach. Technically, the website is built on Drupal 10, leveraging modern web technologies and includes a cookie consent mechanism, indicating a mature digital presence. Security-wise, the site enforces HTTPS and uses consent management but lacks explicit published security policies or incident response information, which could be improved. The absence of WHOIS registration data is a notable gap but does not detract significantly from the overall legitimacy given the comprehensive business content and certifications. Strategic recommendations include enhancing security transparency, publishing incident response contacts, and improving WHOIS registration visibility to bolster trust.

CIFF is a well-established international fashion trade show organizer based in Denmark, operating since 1998. The company hosts bi-annual events that serve as major platforms for the fashion industry, targeting exhibitors and buyers globally. Their website reflects a professional and modern digital presence built on Next.js and React, with strong mobile optimization and user experience. Privacy compliance is robust, featuring a comprehensive privacy policy linked to their parent company Bella Group and a fully integrated Cookiebot consent mechanism. Security posture is strong with HTTPS, security headers, and no visible vulnerabilities, although DNSSEC is not enabled and no explicit security or incident response policies are published. Overall, CIFF demonstrates a mature business and digital infrastructure with high trustworthiness and compliance.

Rosneft is a leading Russian integrated oil and gas company with a strong market position and a comprehensive portfolio of upstream and downstream operations. The website reflects a mature enterprise with clear business focus on energy production, refining, and investor relations. The technical infrastructure uses standard web technologies including jQuery and Yandex Maps API, with moderate performance and basic mobile optimization. Security posture is adequate with HTTPS enabled and domain transfer protection, but lacks advanced security headers and DNSSEC. Privacy compliance is partial, with no explicit cookie consent or detailed privacy policy pages detected. Overall, the website is professional and trustworthy, but could improve in security and privacy transparency.

The Norwegian Refugee Council (NRC) is a well-established independent humanitarian organization based in Norway, operating globally in over 40 countries to assist displaced persons and refugees. The website reflects a mature digital presence with comprehensive content about their mission, latest news, and global projects. The organization targets donors, partners, and the general public interested in humanitarian aid. Their business model is non-profit, focusing on aid delivery and expert deployment through their NORCAP program. The site is professionally designed with consistent branding and clear trust indicators such as certifications and social media presence. Technically, the website employs a modern technology stack including jQuery, Google Tag Manager, Facebook Pixel, Matomo Analytics, Hotjar, and Azure Application Insights, indicating a sophisticated approach to analytics and user engagement. The CMS appears to be Episerver, supporting a structured and scalable content management environment. Performance and mobile optimization are good, with accessibility and SEO features well implemented. From a security perspective, the site enforces HTTPS and uses multiple security best practices, although explicit security headers were not fully confirmed in the HTML. No vulnerabilities or exposed sensitive data were detected. Privacy compliance is strong, with clear privacy and cookie policies and GDPR adherence. Contact information is transparent and verified, enhancing business credibility. The lack of public WHOIS data suggests privacy protection, which is justified for this type of organization. Overall, the NRC website demonstrates a high level of professionalism, security, and compliance suitable for a large humanitarian NGO. Strategic recommendations include enhancing visible security headers, publishing a vulnerability disclosure policy, and maintaining ongoing security audits of third-party scripts to mitigate risks.

Mandalay Bay is a premier luxury resort and casino located on the Las Vegas Strip, operated by MGM Resorts International. The website showcases a comprehensive range of services including hotel accommodations, casino gaming, entertainment, dining, pool and wellness amenities, and nightlife options. The site targets leisure travelers and entertainment seekers, positioning itself as a major player in the hospitality industry with a strong brand presence and extensive offerings. Technically, the website is built using modern web technologies such as React and Next.js, supported by robust content delivery networks and analytics tools including Adobe Launch and Branch.io. The site demonstrates excellent performance, mobile optimization, and accessibility, reflecting a mature digital infrastructure. From a security perspective, the site enforces HTTPS, implements key security headers, and provides cookie consent mechanisms aligned with privacy regulations. However, explicit security policies, incident response contacts, and vulnerability disclosure information are not publicly available, representing areas for improvement. Overall, the website is professional, trustworthy, and compliant with privacy standards, with a high security posture and strong business credibility. The absence of WHOIS data for the subdomain is typical and does not detract from legitimacy. Strategic recommendations include publishing detailed security policies and terms of service to enhance transparency and trust.

Vibo SpA is an established Italian manufacturer specializing in innovative fittings for kitchens and wardrobes, serving the furniture industry with a focus on design and quality. The company has a strong market position supported by a well-structured website that targets industry professionals and consumers seeking high-quality Italian-made products. The website demonstrates a good level of digital maturity with modern JavaScript libraries, responsive design, and clear navigation. Cookiebot is implemented for cookie consent management, reflecting compliance with privacy regulations. Security posture is solid with HTTPS, CSRF protection, and domain transfer restrictions, although DNSSEC is not enabled and security headers could be improved. Overall, the website is professional, trustworthy, and compliant with GDPR requirements.

Saltfoss is a newly founded company (2025) focused on innovating nuclear energy technology by developing a fundamentally different nuclear power plant concept. Their flagship product is the Compact Molten Salt Reactor (CMSR) deployed on modular floating power barges designed for sustainability, safety, and cost-effectiveness. The company targets energy market stakeholders and aims to revolutionize energy markets by providing abundant, affordable, and low-emission energy solutions. The website is professionally designed using WordPress and Elementor, with good SEO and mobile optimization. Security posture is adequate with HTTPS and domain transfer protections, but lacks advanced security headers and published security policies. Privacy compliance is partial, with a cookie consent mechanism but no visible privacy or terms policies. Contact information is not explicitly provided, which may impact user trust. Overall, the website and domain registration indicate a legitimate and transparent business entity with room for improvement in security and compliance documentation.

Capital Investment is a Danish real estate investment and asset management company specializing in the Greater Copenhagen property market. Established in 2013, it serves international investors seeking exposure to Danish real estate through comprehensive property management, asset management, and letting solutions. The company positions itself as a trusted local partner with deep market knowledge and a commitment to sustainable value creation. Technically, the website is built on WordPress using the Avada theme and integrates modern SEO and analytics tools such as Yoast SEO, Google Tag Manager, and Hotjar. The site is mobile optimized and provides a professional user experience with clear navigation and branding consistency. Security-wise, the website uses HTTPS with good SSL configuration but lacks advanced security headers and explicit security policies or incident response contacts. Privacy compliance is addressed with a privacy and cookie policy including a consent mechanism, though GDPR compliance details are basic. Overall, the website reflects a credible and professional business presence with room for improvement in security and compliance transparency.

WellPerform is a specialized consultancy and engineering firm operating primarily in the energy sector, offering services in well management, drilling and completion engineering, exploration, and development operations. Their portfolio includes projects in Oil & Gas, Geothermal, Carbon Capture Storage, and Salt Cavern wells, serving over 100 international clients with more than 600 completed projects. The company also provides recruitment services tailored to the energy industry. Technically, the website is built on Webflow and integrates modern web technologies such as Lottie animations, Cookiebot for cookie consent, and live chat tools, reflecting a moderate to good digital maturity. Security-wise, the site enforces HTTPS and includes cookie consent mechanisms but lacks published privacy and terms of service policies, which are critical for compliance and trust. The absence of WHOIS registration data raises concerns about domain legitimacy, although the professional content and contact details suggest a legitimate business presence. Overall, the website is well-designed and functional but would benefit from enhanced transparency and compliance documentation.

Absalon & Co is a Danish real estate advisory company specializing in bridging the gap between the property and retail sectors by offering services focused on optimizing retail leases and enhancing property values. The company emphasizes a holistic and independent advisory approach, targeting property owners, buyers, sellers, and developers. The website is professionally designed using the One.com Web Editor platform and hosted on One.com infrastructure, with moderate performance and basic mobile optimization. Security posture is moderate with HTTPS enabled but lacking security headers and privacy policies, which impacts compliance and trust. The absence of WHOIS registration data raises concerns about domain legitimacy, although the website content is accessible and professional. Strategic improvements in privacy compliance, security headers, and contact transparency are recommended to enhance trust and security.

Lexsos operates a website hosted on the Squarespace platform, targeting a Danish audience with multilingual support via Weglot. The site presents a professional design with clear navigation but lacks detailed business descriptions and contact information. The technical infrastructure is modern, leveraging standard web technologies including jQuery and Cookiebot for cookie consent management. Security posture is solid with HTTPS and HSTS enabled, though additional security headers could enhance protection. Privacy compliance is addressed through a comprehensive cookie consent mechanism, but a dedicated privacy policy page is not explicitly found. The absence of WHOIS data limits domain legitimacy verification, posing a moderate risk. Overall, the website is functional and moderately secure but would benefit from enhanced transparency and business information.

Grumsen Development ApS is a Danish technology company specializing in custom software development, including app development, web development, and system integrations. Established in 2018 and headquartered in Esbjerg, Denmark, the company serves a nationwide business clientele with tailored digital solutions. Their market position is that of a trusted local provider with a diverse portfolio of projects and satisfied clients. The website reflects a professional and modern digital presence, showcasing their expertise and project experience effectively. Technically, the website is built using modern frameworks such as React and Next.js, with TypeScript and mobile app technologies like Swift and Flutter for iOS and Android platforms. The site is fast, mobile-optimized, and SEO-friendly, indicating a mature digital infrastructure. The presence of cookie consent mechanisms and privacy policy indicates attention to privacy compliance. From a security perspective, the site enforces HTTPS and uses secure forms, but lacks some advanced security headers and explicit security policies. No critical vulnerabilities or exposed sensitive data were detected. The WHOIS data aligns well with the business claims, supporting legitimacy and trustworthiness. Overall, the website and business demonstrate a strong digital maturity and security posture suitable for their market segment. Strategic improvements in security policy transparency and DNS security could further enhance trust and compliance.

Val Controls is a company specializing in the manufacture and development of intelligent valve positioners and controllers, targeting industrial sectors such as oil & gas, mining, and power plants. The website positions the company as a world leader in this niche, offering safer, environmentally friendly, and cost-efficient solutions. The business model is primarily B2B, leveraging an e-commerce platform with quote request capabilities to facilitate customer engagement and sales. Technically, the website is built on the Shopify platform using a modern theme (Impact 5.3.0) and employs contemporary web technologies including JavaScript ES modules, Google Tag Manager, and hCaptcha for form security. The site is hosted on Shopify's CDN, ensuring fast performance and excellent mobile optimization. SEO and accessibility practices are implemented at a good level, with structured data enhancing search engine understanding. From a security perspective, the site enforces HTTPS and uses hCaptcha to protect forms, but lacks explicit security headers and published security policies. No privacy or cookie policies were detected, and no direct company contact emails or phone numbers are visible, which limits transparency. The WHOIS lookup failed to retrieve domain registration data, raising concerns about domain legitimacy and ownership verification. Overall, the website demonstrates solid technical implementation and business presentation but has notable gaps in privacy compliance, security transparency, and domain legitimacy. Strategic improvements in these areas would enhance trustworthiness and regulatory adherence.