High-risk security reports

O

ORB Electrics

orbelectrics.co.uk

41

ORB Electrics is a small, family-run electrical contracting company based in the North East of the United Kingdom, established in 1989. The company offers a range of electrical services from minor domestic works to large-scale industrial and commercial electrical installations. Their website reflects a professional and consistent brand image, highlighting certifications from NICEIC which reinforce their credibility in the electrical industry. The target audience includes domestic and commercial customers seeking quality electrical services in the region. Technically, the website is built on Joomla CMS and utilizes common web technologies such as jQuery, Bootstrap, and MooTools. The site is moderately optimized for performance and mobile responsiveness, with a basic level of accessibility and SEO. However, there is no evidence of advanced analytics or tracking tools, and no contact forms or social media integrations were detected in the provided content. From a security perspective, the website lacks visible security headers and there is no information about HTTPS or SSL configuration in the provided data. The presence of CSRF tokens in scripts is a positive sign, but overall security posture is moderate with recommendations to improve HTTPS implementation, add security headers, and ensure secure form handling. The absence of privacy and cookie policies indicates a gap in compliance with data protection regulations such as GDPR. Overall, the website presents a trustworthy and professional business front but would benefit from enhanced security measures and privacy compliance to improve user trust and regulatory adherence. The lack of WHOIS data limits domain legitimacy verification, but the business content and certifications support its authenticity.

L

Security Verification

lakelandtileandbathrooms.co.uk

48

The website www.lakelandtileandbathrooms.co.uk currently serves only as a security verification page employing Google reCAPTCHA v3 to prevent automated access. No actual business content, contact information, or legal policies are present, indicating that the site is either under protection or not fully deployed. The domain WHOIS lookup failed due to the domain name violating Nominet UK naming rules, suggesting the domain is invalid or misconfigured. This severely limits the ability to assess the business or technical maturity of the entity behind the site. Technically, the site uses Bootstrap 5.3.3 and Google reCAPTCHA v3, but lacks visible security headers and HTTPS information, which are critical for secure web operations. The absence of privacy and cookie policies further indicates poor compliance with data protection regulations. The site is effectively blocked by a WAF or similar security mechanism, preventing full content access and analysis. From a security perspective, the use of reCAPTCHA is a positive measure against bots, but the lack of other security best practices and the invalid domain registration raise significant concerns. The overall risk is high due to the inability to verify legitimacy, lack of transparency, and minimal content. Strategic recommendations include resolving domain registration issues, implementing HTTPS and security headers, publishing privacy and cookie policies, and providing clear business and contact information to improve trust and compliance.

S

Simply Fone Ltd

simplyfone.com

47

Simply Fone Ltd operates as a UK-based telecommunications provider specializing in affordable international and domestic call services for both residential and business customers. The company positions itself as a low-cost alternative with a range of telecom solutions including line rentals, mobile override, business telephone systems, and bulk SMS services. Their market presence is supported by 24/7 customer support and competitive pricing, targeting UK consumers and businesses seeking cost-effective telecom options. Technically, the website employs legacy JavaScript libraries and Google Analytics for tracking, with basic SEO and mobile optimization. Security posture is moderate with HTTPS enabled but lacks critical security headers and cookie consent mechanisms, indicating room for improvement in compliance and security best practices. The absence of WHOIS registration data for the domain raises concerns about domain legitimacy and registration status, which impacts overall trustworthiness. Strategic recommendations include enhancing security headers, implementing GDPR-compliant cookie consent, verifying domain registration, and improving mobile responsiveness to strengthen both security and user experience.

C

...

cryptorun.games

48

The analyzed website is a minimalistic redirect landing page primarily serving as an affiliate gateway to a crypto gaming site (cryptorun.games). It lacks substantive content, business information, or user engagement features. The domain is very recently registered (March 2024) and uses Cloudflare DNS without DNSSEC, indicating basic technical setup but limited maturity. The site employs obfuscated JavaScript and a hidden form with encrypted data, which raises concerns about transparency and potential security risks. No privacy, cookie, or terms of service policies are present, and no contact information is provided, limiting compliance and trust. Overall, the site appears to be a low-trust affiliate marketing platform with questionable content safety due to its association with crypto gaming and potential gambling.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.