Security Directory

3

32-Bit Cafe

32bit.cafe

46

32-Bit Cafe is a small, community-driven platform focused on revitalizing the personal web through self-expression and creativity. It serves a niche audience of website hobbyists and professionals who seek alternatives to mainstream social media, offering various free services such as email, collaborative documents, RSS aggregation, and community forums. The website is well-structured with good navigation and content relevance, supporting a positive user experience for its target audience. Technically, the site uses standard web technologies (HTML, CSS, JavaScript) without reliance on major CMS or frameworks, indicating a lightweight and straightforward infrastructure. Security posture is moderate; while HTTPS is implied, no security headers or DNSSEC are enabled, and no cookie consent mechanism is present. The domain is privacy protected, which aligns with the community's ethos and non-commercial nature. Overall, the site is safe, trustworthy, and professionally maintained but could improve in security and privacy compliance aspects.

lojban.io is a specialized educational platform dedicated to the study and promotion of the constructed language Lojban. It offers free and open-source resources including courses, learning decks, and community engagement via a Discord server. The website targets language enthusiasts and learners interested in logical and constructed languages, positioning itself as a niche educational resource with a small but active user base. The platform is relatively young, established in 2020, and maintains a consistent brand and content quality with regular updates and community involvement. Technically, the website employs modern web technologies such as Bootstrap for styling, Font Awesome for icons, and integrates Google Analytics and Tag Manager for user tracking. It also supports Progressive Web App features, enhancing user experience across devices. Hosting and DNS services are managed via Cloudflare, providing performance and security benefits. The site demonstrates moderate performance and good mobile optimization but lacks some advanced accessibility features. From a security perspective, the site uses HTTPS with a good SSL configuration and has domain transfer protections in place. However, it lacks DNSSEC and important security headers like Content-Security-Policy and X-Frame-Options, which are recommended to enhance security posture. Privacy compliance is limited due to the absence of privacy and cookie policies, which is a notable gap given the use of tracking technologies. No incident response or vulnerability disclosure mechanisms are present. Overall, lojban.io presents a trustworthy and professional educational resource with a solid technical foundation but would benefit from improved privacy compliance and enhanced security headers. Strategic recommendations include implementing privacy and cookie policies, enabling DNSSEC, adding security headers, and establishing a vulnerability disclosure process to strengthen trust and compliance.

L

lipu tenpo

liputenpo.org

56

lipu tenpo is a registered association based in Germany that provides a cultural and educational platform primarily in the Toki Pona language. The website hosts a collection of articles and multimedia content licensed under CC BY-SA 4.0, targeting a general audience interested in this niche language and culture. The organization engages its community through Discord, Patreon, and Linktree, indicating active outreach and support mechanisms. The domain was registered in 2021, consistent with the association's founding timeline. Technically, the website is built with standard HTML5 and CSS3, utilizing Google Fonts and GoatCounter for lightweight, privacy-conscious analytics. The hosting is managed via Name.com, with no CMS or major frameworks detected, suggesting a custom or static site approach. The site is mobile-optimized with good navigation and SEO practices, though accessibility features are basic. Performance is moderate, with no blocking or WAF detected. From a security perspective, the site uses HTTPS and has domain transfer protections enabled, but lacks DNSSEC and security headers such as Content-Security-Policy or X-Frame-Options. There is no visible privacy or cookie policy, nor incident response or vulnerability disclosure information, which are areas for improvement. No sensitive data exposure or vulnerabilities were detected in the content. Overall, the security posture is moderate but could be enhanced with standard best practices. The overall risk assessment is low to moderate, with no critical issues found. Strategic recommendations include implementing DNSSEC, adding security headers, publishing privacy and cookie policies, and providing incident response contacts to improve compliance and trust. The site is trustworthy for its intended educational and cultural purpose but would benefit from enhanced security and privacy transparency.

The website 'lipamanka.gay' is a personal site primarily focused on sharing essays, stories, and linguistic resources related to the creator's interests. It is a small-scale, niche site without commercial intent or business contact information. The site is hosted likely on GitHub Pages with domain registration through NameCheap, protected by privacy services. The technical infrastructure is basic, relying on standard HTML, CSS, and JavaScript, with minimal external dependencies. Analytics are implemented via GoatCounter, providing lightweight user tracking without aggressive data collection. From a security perspective, the site uses HTTPS and has domain transfer protection enabled, but lacks DNSSEC and security headers, which could be improved to enhance security posture. There are no privacy or cookie policies, nor terms of service, which limits compliance with GDPR and other privacy regulations. No contact or incident response information is provided, reducing transparency and trustworthiness from a security standpoint. Overall, the site is safe for general audiences, containing no adult or explicit content. The domain registration is recent and privacy protected, appropriate for a personal website. The lack of business information and policies limits the site's credibility and compliance maturity. Strategic improvements in security headers, privacy disclosures, and contact transparency would enhance trust and compliance.

The website ap5.dev is a personal professional portfolio and blog belonging to Anna Kudriavtsev, focusing on computing systems design and software development with an emphasis on correctness and maintainability. The site positions itself as a personal brand rather than a commercial business, targeting a general audience interested in technology and software development. The business model is primarily informational and portfolio-based, with links to a resume and GitHub repository. Technically, the website uses standard modern web technologies including HTML5, CSS3, and JavaScript, with external resources such as Google Fonts and a chat widget from cactus.chat. The site is moderately optimized for mobile and SEO, with good design quality and clear navigation. However, no CMS or hosting provider details are evident, and performance is moderate. From a security perspective, the site uses HTTPS and does not expose forms or sensitive data, but lacks explicit security headers and formal privacy or cookie policies. No vulnerability disclosure or incident response information is provided. The domain registration is privacy protected, which is appropriate for a personal site. Overall, the security posture is adequate but could be improved with additional headers and compliance documentation. The overall risk is low given the nature of the site, but strategic recommendations include implementing privacy and cookie policies, adding security headers, and providing vulnerability disclosure information to enhance trust and compliance.

H

healthyareastore

healthyareastore.com

59

healthyareastore.com is a newly established e-commerce website launched in early 2024, specializing in health and beauty products including makeup, skin care, hair care, and nutritional supplements. The site targets general consumers interested in improving their health and wellbeing through quality products. The business operates primarily online with a straightforward retail model and a focus on product variety within the health and beauty niche. The website is hosted on the edit.site platform and uses modern web technologies including JavaScript and REST APIs to deliver content and e-commerce functionality. The design is professional and mobile-optimized, providing a good user experience with clear navigation and calls to action. Security posture is basic but adequate with HTTPS enabled and domain transfer protection in place, though DNSSEC is not enabled and security headers are absent. Privacy compliance is addressed through a cookie consent mechanism and a privacy policy page, but terms of service and incident response policies are missing. Contact information is limited to an email address and a subscription form, with no phone or physical address provided. Overall, the site presents a moderate risk profile with room for improvement in security, compliance, and business credibility indicators.

The website 'noololly.studio' is a personal portfolio site primarily showcasing a software project named 'Uno'. The site is minimalistic and informal, targeting a general audience likely familiar with the site owner. The business model is non-commercial, focusing on personal project display rather than a formal business offering. The domain registration data is inconsistent, showing a future creation date which undermines trust and raises questions about data accuracy or legitimacy. Technically, the site uses basic HTML, CSS, and minimal JavaScript with no detected CMS or advanced frameworks. Hosting appears to be via Name.com based on WHOIS data. Security posture is weak with no security headers, no DNSSEC, and no privacy or cookie policies. No contact information or incident response details are provided, limiting trust and compliance. Overall, the site is low risk but lacks professional security and privacy practices.

P

index · pigeon

pigeon.life

55

The website pigeon.life is a small-scale personal or creative project site launched in 2019, featuring interactive tools such as language translation, pixel plotting, morse code encoding, and font displays. It also links to a GitHub profile, indicating a developer or hobbyist focus. The site is built using modern web technologies including the Astro framework and is hosted on DigitalOcean, reflecting a moderate level of technical maturity. However, the site lacks formal business information, contact details, and compliance policies, which limits its professional credibility. Security posture is minimal with no security headers or privacy policies detected, and DNSSEC is not enabled on the domain. The domain registration is privacy protected, which is typical for personal projects and does not raise immediate concerns. Overall, the site is safe and suitable for general audiences but would benefit from improved security and compliance measures.

The website pontushenriksson.com represents a personal portfolio for an individual web developer and programmer named Pontus Henriksson. The site is currently under development with a legacy site linked for reference. The business model is focused on showcasing skills and previous work to attract freelance or contract opportunities. The target audience includes potential clients or employers seeking web development and design services. The website is hosted on Cloudflare Pages and uses basic modern web technologies such as HTML5, CSS3, and JavaScript. The design is responsive and user-friendly, though content is minimal and lacks comprehensive business or contact information. From a security perspective, the site benefits from HTTPS and domain transfer protection but lacks DNSSEC and security headers, which are recommended to enhance protection. No privacy, cookie, or terms of service policies are present, indicating limited compliance with GDPR or other privacy regulations. No contact emails, phone numbers, or social media links are provided, reducing business credibility and user trust. Analytics are implemented via Cloudflare Pages Analytics with minimal user tracking. Overall, the website is safe with no adult or questionable content detected. The domain registration is consistent with the website's new status and shows no suspicious patterns. The security posture is moderate but can be improved by adding security headers and privacy policies. The site’s technical implementation is adequate for a personal portfolio but lacks advanced SEO and accessibility features. Strategic recommendations include implementing privacy and cookie policies, adding security headers, providing clear contact information, enabling DNSSEC, and enhancing SEO and accessibility to improve user trust and compliance.

J

JoubaMety

joubamety.com

54

JoubaMety is a personal website representing Jan Rašnovský, a content creator and developer specializing in Minecraft machinima, video production, and programming. The site serves as a portfolio and community hub, linking to various social media and community platforms. The business operates as a small personal brand targeting Minecraft and machinima enthusiasts as well as programming communities. Technically, the website is well-constructed using modern CSS frameworks like Tailwind CSS and Ripple UI, with JavaScript enhancements and Cloudflare DNS. Performance and mobile optimization are good, and SEO practices are adequately implemented. Security posture is decent with HTTPS and domain transfer protection, but lacks DNSSEC and security headers. Privacy and compliance policies are absent, representing a compliance gap. Overall, the site is trustworthy and safe for general audiences.

I

is-a.dev - Free subdomains for developers

is-a.dev

61

The website is-a.dev offers a free subdomain registration service targeted primarily at developers. It enables users to obtain free `.is-a.dev` subdomains by following instructions hosted on a GitHub repository. The service is positioned as a niche developer tool with a small-scale operation founded in 2020. The website content is clear, relevant, and professionally presented with consistent branding and a focus on developer engagement through GitHub and Discord communities. From a technical perspective, the site uses modern web technologies including HTML5, CSS3, JavaScript, and is hosted behind Cloudflare, ensuring fast performance and good mobile optimization. The presence of Carbon Ads and Cloudflare Insights indicates minimal advertising and analytics usage, with a low level of user tracking. SEO and accessibility are adequately addressed, though accessibility is basic. Security posture is solid with HTTPS enforced and no visible vulnerabilities or exposed sensitive data. However, the site lacks explicit security headers and formal privacy or cookie policies, which are important for compliance and trust. Incident response is partially addressed via a GitHub abuse reporting mechanism, but no dedicated security contact or vulnerability disclosure policy is present. Overall, the website is trustworthy and functional with a good balance of usability and security for its scope. The main risks relate to privacy compliance and formal security governance, which could be improved to enhance user trust and regulatory adherence.

H

H4LO

h4lo.ca

56

H4LO.ca is a personal portfolio website created and maintained by an individual developer named H4LO. The site serves as a showcase for projects, an online storefront, and a code repository linked via GitHub. The business model is personal branding and project demonstration, targeting a general audience interested in technology and development. The website is relatively new, founded in 2024, and positions itself as a niche personal brand rather than a commercial enterprise. The content is concise, well-structured, and professionally presented with consistent branding and clear navigation.

R

refact0r

refact0r.dev

58

The website refact0r.dev is a personal portfolio and blog belonging to a student interested in computer science, web development, and design. It serves as a platform to showcase projects, share blog content, and present personal interests. The site is built using modern web technologies including SvelteKit, and it demonstrates good design quality, mobile optimization, and user experience. However, it lacks formal business information, contact details, and compliance documentation such as privacy or cookie policies. From a technical perspective, the site uses a modern JavaScript framework (SvelteKit) and includes minimal analytics via umami, indicating a lightweight and privacy-conscious approach. The performance appears fast, and the site is mobile responsive. However, no security headers were detected in the provided data, and there is no evidence of HTTPS enforcement or advanced security practices. Security posture is moderate but could be improved by implementing standard security headers, privacy policies, and incident response information. The absence of contact information and compliance documents reduces trust and business credibility. No vulnerabilities or suspicious content were detected, and the domain registration uses privacy protection, which is appropriate for a personal site. Overall, the site is a well-designed personal portfolio with room for improvement in security, privacy compliance, and business transparency. Strategic recommendations include adding privacy and cookie policies, implementing security headers, providing contact information, and considering a vulnerability disclosure policy to enhance trust and compliance.

The website perseuslynx.dev is a personal portfolio and blog site for an individual named Perseus Lynx. It serves as a digital space to showcase projects, share blog posts, and provide personal information. The site targets a general audience interested in technology and personal projects. The business model is that of a personal brand with no commercial or enterprise scale operations. Technically, the site uses standard web technologies including HTML5, CSS3, and JavaScript, with modern image formats like WebP. Hosting appears to be via Cloudflare, with analytics provided by Umami and Cloudflare Insights. The site is moderately optimized for mobile and performance but lacks advanced SEO and accessibility features. Security posture is basic; HTTPS is presumed but no explicit security headers or policies are present. No privacy, cookie, or terms of service policies are found, indicating low privacy compliance. No contact information or incident response details are provided, limiting business credibility and user trust. Overall, the site is functional and professional for a personal portfolio but lacks formal security and compliance measures.

J

Jan's Website

jan-osing.de

57

Jan's website is a personal portfolio and social presence site for a young developer from Germany. It focuses on personal interests such as gaming, anime, open source software, and Linux distributions. The site is simple, well-structured, and provides links to various social and community platforms. The technical infrastructure is basic, relying on static HTML and CSS with Cloudflare DNS services. There is no evidence of advanced frameworks or CMS usage. Security posture is minimal with no visible security headers or policies, but no critical vulnerabilities or malicious content were detected. Privacy compliance is lacking as no privacy or cookie policies are present. Overall, the site is low risk but would benefit from improved security and compliance documentation.

The website pyrox.dev is a personal blog and portfolio site operated by an individual known as 'dish', who identifies as a student, sysadmin, and UX crafter. The site focuses on topics related to computers, programming, and system administration, targeting a general audience interested in technology. The content is well-structured, with a clear navigation menu and recent blog posts, though limited in volume. The site uses the Lume static site generator, indicating a modern and lightweight technical infrastructure. Performance and mobile optimization are good, but accessibility features are basic. Security posture is moderate; the site lacks security headers and formal privacy or cookie policies, which impacts compliance and trust. No forms or data collection mechanisms are present, reducing privacy risks but also limiting user engagement. The domain registration is privacy protected, which is typical for personal sites, and no suspicious patterns were detected. Overall, the site is safe, professional, and suitable for general audiences.

The website terminaate.site is a personal portfolio of a young web developer from Russia specializing in React and Next.js, with interests in backend and DevOps. The site serves as a showcase of skills and projects, targeting potential collaborators or clients interested in modern web development technologies. The technical infrastructure is modern, leveraging popular JavaScript frameworks, bundlers, and backend tools, hosted with Cloudflare DNS and employing HTTPS. The site is well-designed with good navigation and mobile optimization, though it lacks formal privacy and cookie policies, as well as contact information, which limits its professional completeness. From a security perspective, the site uses HTTPS and modern frameworks but lacks security headers and formal security policies. The WHOIS data raises concerns due to an inconsistent domain creation date set in the future and a registrant organization name that does not clearly align with the personal portfolio branding. No WAF or blocking mechanisms are detected, and the site includes minimal user tracking via Umami analytics. Overall, the security posture is moderate but could be improved with better compliance and security practices. The overall risk is moderate with no critical vulnerabilities detected, but the lack of privacy compliance and contact information, combined with suspicious WHOIS data, suggests caution. Strategic improvements in security headers, privacy policies, and domain registration accuracy are recommended to enhance trust and compliance.

The website aprl.cat is a personal site belonging to an individual named April, a 20-year-old from the UK with interests in programming, music, skateboarding, and cats. The site serves as a personal blog and portfolio showcasing her hobbies, technical skills, and social media presence. It targets a general audience interested in personal tech and music culture. The site is small-scale and non-commercial, with no evident business operations or monetization. Technically, the site is custom-built with vanilla HTML, CSS, and JavaScript, hosted behind Cloudflare DNS and CDN services. It integrates WebSocket connections to the Lanyard API for real-time Discord presence updates. The site lacks a CMS and advanced frameworks but uses modern programming languages and tools in the background as described by the owner. Security posture is moderate with domain transfer protections but lacks DNSSEC and security headers. Privacy and cookie policies are absent, reducing compliance. WHOIS data shows inconsistencies, notably a domain creation date in the future, which raises questions about domain legitimacy. Overall, the site is functional and moderately secure but would benefit from improved security headers, privacy compliance, and WHOIS data accuracy.

The website garnix.dev is a personal blog and content sharing platform maintained by an individual named Emilia. It primarily offers blog posts, music recommendations, and personal content, targeting a general audience interested in technology and related community topics. The site is small in scale and operates as a niche personal blog without commercial business infrastructure or formal corporate presence. Technically, the site is built with standard HTML, CSS, and JavaScript, featuring a simple but consistent design and basic mobile optimization. It uses a fetch API call to an external HTTPS endpoint for form submissions, indicating some level of modern web technology usage. However, there is no evidence of advanced frameworks, CMS, or hosting provider details. SEO and accessibility features are basic, and no structured metadata or Open Graph tags are present. From a security perspective, the site uses HTTPS for external requests but lacks visible security headers and formal security policies. The contact form is minimal and lacks CSRF protection or input validation beyond a non-empty check. No privacy, cookie, or terms of service policies are published, which limits compliance with GDPR and other privacy regulations. The domain uses WHOIS privacy protection, which is common for personal sites and justified here. No suspicious or malicious indicators were found. Overall, the site is safe and trustworthy for general audiences but would benefit from improved security practices, privacy disclosures, and business contact information to enhance credibility and compliance. The AI score reflects a functional but basic personal website with room for improvement in security and privacy compliance.

ProjNULL is a small team of IT students focused on learning programming and experimenting with projects, primarily participating in hackathons. The website serves as a hub for their activities, showcasing their projects and blog content. The business model is educational and experimental, targeting fellow students and programming enthusiasts. The site is hosted by WEDOS Internet, a reputable registrar and hosting provider. Technically, the site uses standard web technologies such as HTML5, CSS3, and JavaScript, with moderate performance and good mobile optimization. However, it lacks advanced frameworks or CMS platforms and has basic SEO and accessibility features. Security posture is minimal, with no detected security headers or published security policies, and no contact information for incident response. Privacy and cookie policies are absent, indicating low privacy compliance. Overall, the site is safe for general audiences and does not contain adult or questionable content.

C

Corporation Service Company (Aust) Pty Ltd

runnersworldonline.com.au

50

Runner's World Australia and New Zealand is an established online media platform providing running news, training advice, inspiring stories, and gear reviews targeted at runners and fitness enthusiasts in Australia and New Zealand. The website leverages a WordPress CMS with a modern Newspaper theme and integrates multiple analytics and advertising technologies including Google Analytics, Google Tag Manager, Facebook Pixel, and Google AdSense. The technical infrastructure is solid with good mobile optimization and SEO practices, although performance is moderate. Security posture is adequate with HTTPS enabled but lacks advanced security headers and published security policies. Privacy compliance is weak due to absence of privacy and cookie policies. Overall, the business appears credible with consistent WHOIS data and professional content presentation.

P

PURE Sports Nutrition

puresportsnutrition.com

62

PURE Sports Nutrition is a New Zealand-based e-commerce business specializing in premium sports nutrition products including sports drinks, energy gels, protein powders, and hydration solutions. The website is professionally designed and hosted on the Shopify platform, leveraging modern web technologies and multiple third-party marketing and analytics integrations. The brand positions itself as a clean, performance-focused nutrition provider targeting active lifestyle consumers. Technically, the site demonstrates good performance and mobile optimization, though accessibility features are basic. Security posture is solid with HTTPS and no visible vulnerabilities, but lacks explicit security headers and formal policies. The absence of WHOIS data for the domain introduces some uncertainty about domain registration legitimacy. Overall, the site is functional and trustworthy but would benefit from enhanced privacy compliance and transparency.

R

Rokeby Nutrition

rokebyfarms.com.au

67

Rokeby Nutrition is a small Australian nutrition food company specializing in award-winning dairy products and nutrition beverages, operating primarily through an e-commerce Shopify platform. The website presents a professional and consistent brand image targeting health-conscious consumers in Australia. Technically, the site leverages modern Shopify technologies, including Google Tag Manager and Facebook Pixel for analytics and marketing, and employs hCaptcha for form security. The site is mobile-optimized with good performance and SEO practices. Security posture is adequate with HTTPS enforced and clientTransferProhibited domain status, but could be improved by enabling DNSSEC and adding advanced security headers. Privacy compliance is basic with a privacy policy and cookie consent banner, but lacks explicit GDPR compliance details. Contact information is limited to forms without direct emails or phone numbers. Overall, the site is trustworthy and well-structured but would benefit from enhanced security and privacy transparency.

P

Polar Global

polar.com

67

Polar Global is a recognized brand specializing in heart rate monitors, fitness trackers, and sports watches targeting fitness enthusiasts and athletes worldwide. The website presents professional content aligned with its business focus and employs modern web technologies including Google Tag Manager and Cookiebot for analytics and privacy compliance. The site is secured with HTTPS and implements a comprehensive cookie consent mechanism, reflecting a good privacy posture. However, the absence of WHOIS data and explicit contact or security policy information limits full trust assessment. Overall, the website is professional and trustworthy with room for improvement in transparency and security disclosures.

G

Gold Coast Airport

goldcoastairport.com.au

66

Gold Coast Airport operates as a regional airport serving the Gold Coast and Northern NSW regions in Australia, providing a range of services including flights, parking, car rentals, shopping, and dining. The website is professionally designed with clear navigation and good mobile optimization, reflecting a mature digital presence. The technical infrastructure incorporates modern web technologies and third-party marketing and analytics tools such as Google Tag Manager, Facebook Pixel, AdRoll, and Yieldify, indicating a focus on user engagement and marketing effectiveness. Security posture is generally good with HTTPS enforced and no visible sensitive data exposure; however, the absence of security headers and explicit privacy and cookie policies suggests room for improvement in compliance and security best practices. The WHOIS data is limited due to registrar privacy policies, but no suspicious indicators are present, supporting the legitimacy of the domain and business. Overall, the website is trustworthy and well-positioned to serve its target audience of travellers and corporate partners.

E

Experience Gold Coast

destinationgoldcoast.com

70

Experience Gold Coast operates as a regional tourism and experience promotion platform focused on the Gold Coast region in Australia. The website provides comprehensive information on attractions, events, accommodation, and student resources, positioning itself as a key destination marketing entity. The business is relatively new, founded in 2022, and leverages partnerships with local cultural and educational organizations to enhance its offerings. Technically, the website is built on Sitecore CMS, hosted with Azure DNS, and employs a modern tech stack including Bootstrap 4 and various analytics and tracking tools. The site is well-structured with good SEO and accessibility features, though performance is moderate. Security posture is solid with HTTPS and domain locking, but DNSSEC is not enabled and no explicit security or privacy policies are visible. The site extensively uses third-party tracking pixels, indicating a high level of user data collection without visible consent mechanisms. Overall, the website is professional and trustworthy but would benefit from enhanced privacy compliance and clearer contact and security policies.

E

Experience Gold Coast

experiencegoldcoast.com

70

Experience Gold Coast operates a comprehensive tourism and education portal focused on promoting the Gold Coast region in Australia. The website offers rich content including attractions, events, accommodation, and student resources, positioning itself as a regional destination marketing organization. The business is relatively new, founded in 2022, and targets tourists, students, and locals interested in exploring the Gold Coast. The company leverages partnerships with local arts, education, and event organizations to enhance its offerings. Technically, the website is built on a modern stack including Sitecore CMS, Bootstrap 4, and hosted likely on Microsoft Azure infrastructure. It integrates multiple third-party analytics and marketing tools such as Microsoft Application Insights, Google Tag Manager, TikTok Pixel, and others, indicating a mature digital marketing approach. The site is mobile optimized and accessible with good SEO practices. From a security perspective, the website enforces HTTPS and uses domain status locks to protect domain integrity. However, it lacks DNSSEC and explicit security headers in the HTML content. Privacy compliance is weak due to the absence of visible privacy and cookie policies and consent mechanisms. No incident response or vulnerability disclosure policies are published. Extensive third-party tracking scripts raise privacy concerns. Overall, the website is professional and functional with good business credibility but requires improvements in privacy compliance and security hardening to reduce risk and enhance user trust.

M

Marathon-Photos.com Limited

marathonphotos.live

59

Marathon Photos Live is a globally recognized leader in mass participation event sports photography, operating in 70 countries and serving millions of athletes. The company specializes in capturing and delivering live race images, positioning itself as a key service provider in the sports media sector. Their website reflects a professional and consistent brand image with a focus on user experience and accessibility for athletes and event organizers worldwide. Technically, the site is built on modern frameworks such as Vue.js, with good mobile optimization and SEO practices, although some accessibility features could be enhanced. Security posture is adequate with HTTPS enabled and cookie consent implemented, but lacks advanced security headers and published security policies. The domain is privacy protected but consistent with the business profile, and no suspicious indicators were found. Overall, the website demonstrates a mature digital presence with room for security and compliance improvements.

micr0byte is a small-scale developer and community builder focused on creating accessible tools for the Fediverse and open-source ecosystem. The website showcases a variety of open-source projects, including accessibility bots and AI-powered terminal assistants, targeting developers and technology enthusiasts. The site demonstrates a strong commitment to privacy, inclusivity, and practical technology solutions. Technically, the website employs modern web technologies such as HTML5, CSS3, JavaScript, and Three.js, with backend projects primarily in Go, Python, and C#. The site is well-designed, mobile-optimized, and provides a seamless user experience with clear navigation and professional content. Security posture is moderate; while no critical vulnerabilities or exposed sensitive data are evident, the absence of security headers, privacy and cookie policies, and vulnerability disclosure mechanisms represent areas for improvement. Overall, the website is trustworthy and professional, but enhancing privacy compliance and security best practices would strengthen its risk profile.

C

Commenter25

commenter.cc

66

Commenter25 is a personal website showcasing the work and interests of an individual developer and enthusiast focused on Linux, web development, PC gaming, security, privacy, and FOSS. The site serves as a portfolio and creative outlet, featuring various mods, projects, and personal expressions. The market position is niche, targeting tech-savvy and gaming communities with a strong personal branding approach. Technically, the site is built with standard web technologies (HTML, CSS, JavaScript) and hosted on Neocities, indicating a small-scale, self-managed infrastructure. The website is well-structured with good content quality and basic SEO and accessibility features. Security posture is moderate with HTTPS implied but lacking advanced security headers and policies. Privacy compliance is minimal with a basic privacy policy but no cookie consent or GDPR indicators. Overall, the site is safe, trustworthy, and suitable for general audiences with no adult or questionable content detected.

The website micenest.xyz represents a nascent creative collective or idea incubation platform with minimal current content. The site serves primarily as a placeholder with a unique custom font and a promise of future content additions by 2025. The business behind the domain is registered under a privacy-protected entity, Private by Design, LLC, based in the US, consistent with the early-stage nature of the project. The lack of detailed business information, contact details, or policies indicates the site is not yet fully operational or publicly mature. From a technical perspective, the website employs basic HTML and CSS with a custom font and minimal external dependencies. Hosting is provided by Porkbun, LLC, the domain registrar. There is no evidence of advanced frameworks, CMS, or analytics tools. Performance and mobile optimization are basic but functional. SEO and accessibility features are minimal, reflecting the placeholder status. Security posture is limited; no security headers or DNSSEC are enabled, and no privacy or cookie policies are present. The domain uses privacy protection, which is reasonable for the business type and stage. No vulnerabilities or malicious indicators were detected. Overall, the site is safe but lacks maturity in security and compliance. The overall risk is low given the minimal content and no sensitive data handling. Strategic recommendations include implementing security best practices, adding privacy and cookie policies, and providing contact and incident response information to improve trust and compliance as the site develops.

K

KitsuDev

kitsunes.dev

48

KitsuDev is a small-scale technology service provider specializing in hosting Forgejo instances and offering free static page hosting through its KitsuPage service. The website targets developers and small project owners who seek free and safe hosting solutions. The business model is primarily donation-supported, emphasizing community and small-scale operations. The site branding is consistent and content quality is good, focusing on clear messaging and developer-centric services. Technically, the website is built on Forgejo, a modern Git forge platform, with standard web technologies including JavaScript, HTML5, and CSS3. The site performs well with fast loading times and good mobile optimization. Accessibility is basic but functional. SEO practices are present but could be enhanced. The infrastructure appears modern and well-maintained, though hosting provider details are not explicitly disclosed. From a security perspective, the site enforces HTTPS and implements CSRF tokens, indicating a baseline security posture. However, it lacks explicit security headers such as Content Security Policy and HSTS, and does not provide privacy or cookie policies, which are important for compliance and user trust. No contact information or incident response channels are provided, limiting transparency. No vulnerabilities or exposed sensitive data were detected in the HTML content. Overall, the website presents a moderate risk profile with good technical foundations but gaps in privacy compliance and security best practices. Strategic improvements in policy publication, security headers, and contact transparency would enhance trust and compliance. The domain uses privacy protection, which is justified given the small-scale nature of the business. No suspicious patterns were found in WHOIS data or website content.

The Catppuccin Webring is a community-driven website that aggregates links to various personal and developer websites themed around the Catppuccin aesthetic. It serves as a niche platform for enthusiasts and developers to connect and share their sites. The website is simple, primarily built with HTML and CSS, and uses the ringfairy framework to manage the webring functionality. There is no indication of commercial activity or a formal business entity behind the site. From a technical perspective, the site is lightweight and performs well with good mobile optimization and basic accessibility. However, it lacks advanced SEO features and does not implement security best practices such as HTTPS enforcement or security headers. No analytics or tracking technologies are present, indicating a privacy-conscious or minimalistic approach. Security posture is minimal; no security policies, incident response contacts, or vulnerability disclosures are provided. The absence of HTTPS confirmation and security headers lowers the security score. Privacy compliance is also lacking, with no privacy or cookie policies found. The site does not collect user data via forms or other means, reducing privacy risks but also limiting engagement. Overall, the site is safe and appropriate for general audiences, with no adult or explicit content detected. The lack of business information and policies suggests it is a hobbyist or community project rather than a commercial enterprise. Strategic recommendations include implementing HTTPS, adding privacy and cookie policies, and improving security headers to enhance trust and compliance.

The website 'Scrumpy System' at uwu.gal represents a small technology-focused community comprising software engineers, community managers, and web developers. The site provides a professional and visually consistent experience with clear navigation and social media integration, targeting a general audience interested in technology and software development. The business model appears to be community and service-oriented without explicit commercial transactions or e-commerce features. The domain is relatively new, created in late 2022, aligning with the site's small-scale and emerging presence. Technically, the site employs modern web technologies including HTML5, CSS3, JavaScript, Google Fonts, and FontAwesome icons. Hosting and DNS are managed via Cloudflare, ensuring good SSL configuration and moderate performance. The site is mobile optimized and includes interactive elements such as clocks and a starmap iframe. However, accessibility features are basic, and SEO is adequately addressed through meta tags and Open Graph data. From a security perspective, the site benefits from HTTPS and domain transfer protection but lacks DNSSEC and important security headers like Content-Security-Policy. There are no published privacy, cookie, or incident response policies, which limits compliance with GDPR and other regulations. No forms or data collection mechanisms are present on the main page, reducing immediate risk but also limiting user engagement features. Overall, the website is safe and professional but would benefit from enhanced privacy and security policies, improved transparency, and additional compliance measures. Strategic recommendations include enabling DNSSEC, publishing privacy and cookie policies, adding security headers, and establishing incident response and vulnerability disclosure protocols to strengthen trust and security posture.

H

HRT Cafe

hrtcafe.net

58

HRT Cafe is a niche healthcare informational website focused on providing resources and vendor listings for DIY hormone replacement therapy (HRT) targeted at transgender individuals who cannot access traditional medical channels. The site offers detailed medication guides, vendor information for homebrew and pharmaceutical suppliers, and DIY compounding instructions. The business operates as a small-scale, community-oriented resource launched in early 2024, with a clear focus on serving a specialized audience. Technically, the website employs a modern frontend stack including Bootstrap, jQuery, and Font Awesome, hosted via Cloudflare. The site is mobile-optimized with good navigation and content structure, though accessibility features are basic. No CMS or advanced analytics tools are detected, indicating a lightweight and privacy-conscious implementation. From a security perspective, the site enforces HTTPS and uses Cloudflare as registrar and likely CDN provider, but lacks DNSSEC and security headers such as Content-Security-Policy or X-Frame-Options. There are no published security or incident response policies, and privacy compliance is limited due to absence of privacy and cookie policies. Contact information is minimal, limited to a ProtonMail email address. Overall, the website is functional, informative, and safe for general audiences, but would benefit from enhanced security practices, privacy compliance improvements, and more transparent business information to increase trust and credibility.

P

Private by Design, LLC

fedi.gay

39

The website at fedi.gay is a minimal, non-commercial site containing only a literary poem themed on Elven lore from Tolkien's universe. There is no business description, contact information, or commercial content. The domain is registered to Private by Design, LLC, a US-based entity, but the website content does not reflect any business operations or services. The domain WHOIS data is suspicious due to a future creation date, which raises concerns about legitimacy. Technically, the site uses basic HTML and CSS with no advanced frameworks or scripts detected. There are no privacy, cookie, or terms of service policies, and no contact or incident response information is provided. Security posture is weak with no DNSSEC, no security headers, and unknown SSL status. Overall, the site appears to be a placeholder or personal page rather than a professional business site.

P

Private by Design, LLC

symtrkl.gay

44

The website symtrkl.gay is a personal portfolio and creative hub for Jennifer (SymTrkl), a transfeminine artist and writer based in the United States. The site showcases her work in illustration, web design, FPV drone piloting, and writing, with links to various social media and creative platforms. The business model centers on personal branding, commissions, and community support through platforms like Ko-Fi and Patreon. The site targets a general audience with a mature content segment including erotica and adult social media links. Technically, the site is built with standard HTML, CSS, and JavaScript, hosted via Porkbun with domain privacy protection. The site is moderately optimized for mobile and performance but lacks advanced SEO and accessibility features. No CMS or major frameworks are detected, indicating a custom or static site approach. From a security perspective, the domain uses registrar locks to prevent unauthorized changes but lacks DNSSEC and security headers. There is no visible HTTPS enforcement information, no privacy or cookie policies, and no incident response contacts. The site does not use analytics or tracking scripts, minimizing privacy risks but also limiting business intelligence. Overall, the site is legitimate and consistent with a personal creative portfolio but would benefit from improved security practices, privacy compliance, and clearer contact information to enhance trust and professionalism.

S

🌸 Lily's Moon Garden 🌸

sapphicyearn.ing

48

The website 'Lily's Moon Garden' is a personal hobby site currently under construction, primarily serving as a stable host for a small 88x31 button image. The site is minimalistic with basic HTML and CSS, no dynamic content or forms, and no evident business operations. The owner appears to be an individual named Lily, with a personal Mastodon social link provided. The site content is safe, non-commercial, and targeted at a general audience. Technically, the site uses simple static web technologies with no detected CMS or advanced frameworks. There is no evidence of HTTPS or security headers, and no privacy or cookie policies are present, indicating a low level of privacy compliance and security posture. The domain WHOIS is privacy protected, which is reasonable for a personal site. Overall, the site has a basic design and limited content, with room for improvement in security and compliance.

The website floof.gay is a personal site belonging to an individual named Olivia, serving as a small corner of the internet to share personal interests, social media presence, and blog content. The site is positioned as a personal brand rather than a commercial business, targeting a general audience interested in the author's activities and social links. The site leverages modern web technologies such as Dev.css and web fonts to provide a clean and responsive user experience. The technical infrastructure is straightforward, hosted likely via NameCheap with privacy-protected WHOIS registration, reflecting a typical personal website setup. From a security perspective, the site uses HTTPS and has domain transfer protections enabled, but lacks DNSSEC and security headers, which are recommended for improved security posture. There are no privacy or cookie policies present, and no contact information or forms for data collection, indicating minimal compliance with privacy regulations. No analytics or advertising scripts were detected, suggesting limited tracking and data collection. Overall, the site is safe and appropriate for general audiences, with no adult or questionable content detected. The domain is recently registered and privacy protected, consistent with a personal site. The security posture is moderate but could be improved with additional headers and policies. The site’s business credibility is limited due to its personal nature and lack of formal business information. Strategic recommendations include adding privacy and cookie policies, implementing security headers, enabling DNSSEC, and considering a security.txt file for vulnerability disclosure to enhance trust and compliance.

The website nekomimi.party currently serves as a minimal placeholder page with very limited content and no clear business description or services. The domain is newly registered in early 2023 and uses Cloudflare as its registrar and hosting provider. There is no evidence of a mature or established business presence, and no contact or policy information is provided on the site. Technically, the site uses basic HTML and CSS with no advanced frameworks or CMS detected. Security posture is minimal with no security headers or DNSSEC enabled, and privacy compliance is absent due to missing policies. Overall, the site appears to be in an early or inactive stage of development with low trustworthiness and limited user engagement potential.

KitsuPage is a small technology service offering free static hosting for user repositories, leveraging Git branches to serve content automatically. The service targets developers and users seeking simple, no-cost static site hosting with optional custom domain support. The website is minimalistic, providing essential information about usage and configuration but lacks comprehensive business or legal documentation. Technically, the site uses basic HTML and CSS without advanced frameworks or CMS, and no analytics or advertising scripts are present, indicating a lightweight and privacy-conscious approach. Security posture is limited with no visible security headers or privacy policies, and no contact information is provided except for an abuse report link. The domain uses privacy protection, which is typical for small tech projects, and no suspicious WHOIS patterns were detected. Overall, the site is functional but basic, with room for improvement in security, compliance, and user engagement.

T

Techland S.A.

dyinglightgame.com

62

Techland S.A. operates the official website for the Dying Light franchise, a well-established video game series with over 40 million players worldwide. The website serves as a central hub for game information, news, community engagement, and digital sales, targeting gamers interested in parkour and zombie-themed entertainment. The company maintains a strong market position with consistent branding and a professional online presence. Technically, the website employs modern web technologies including JavaScript, CSS, and integrates third-party services such as Google Tag Manager and Cookiebot for analytics and consent management. Hosting is managed via AWS infrastructure, ensuring reliable performance and scalability. Security posture is solid with HTTPS enforced and domain transfer protections in place, though improvements such as enabling DNSSEC and adding security headers are recommended. Privacy compliance is well addressed with clear policies and cookie consent mechanisms, aligning with GDPR requirements. Overall, the website is professional, secure, and trustworthy, supporting Techland's business objectives effectively.

The website citrons.xyz is a personal website belonging to an individual named raven, featuring journal entries, podcasts, galleries, and personal anecdotes. It does not represent a commercial business or organization and lacks formal business information or contact details. The site is modest in technical sophistication, built with basic HTML and CSS, and hosted on Mythic Beasts servers. There is no evidence of advanced frameworks, CMS, or analytics tools. Security posture is minimal with no detected HTTPS or security headers, and no privacy or cookie policies are present, indicating low compliance with modern web security and privacy standards. The domain is privacy protected and registered in 2021, consistent with the personal nature of the site. Overall, the site is safe for general audiences but lacks professional and security maturity.

T

Toki Pona (official site)

tokipona.org

45

The website tokipona.org serves as the official hub for the Toki Pona constructed language, created by Sonja Lang in 2001. It offers comprehensive educational resources including books, dictionaries, community links, and multimedia content. The site targets language learners, conlang enthusiasts, and educators globally, positioning itself as the authoritative source for Toki Pona with recognition from ISO 639-3 and university usage. The business model is primarily informational with commercial elements through book and merchandise sales. Technically, the site employs modern frontend technologies such as Bootstrap 5, jQuery, Chart.js, and Google Fonts, hosted by Vodien Internet Solutions. Performance and mobile optimization are good, though accessibility and SEO are basic. The site uses HTTPS and Google Analytics for tracking but lacks advanced security headers and privacy/cookie policies, indicating room for compliance improvement. Security posture is moderate with no visible vulnerabilities or exposed sensitive data, but the absence of security headers and vulnerability disclosure policies are notable gaps. The domain is well-established since 2001, registered with a reputable registrar, and shows no suspicious patterns, supporting legitimacy. Overall, the site is professional, content-rich, and trustworthy but should enhance privacy compliance and security best practices to improve user trust and regulatory adherence.

C

Carl Barenbrug

carlbarenbrug.com

55

Carl Barenbrug's website serves as a professional portfolio showcasing his work as a product designer and creative director. The site highlights his involvement with Minimalissimo, 099, and his creative lab FormFeelingFunction®. The business operates in the technology and creative services sector, targeting design professionals and enthusiasts. The website is well-structured with clear navigation and professional design, supporting a niche personal brand model. Technically, the site uses modern web standards with custom fonts and responsive design, hosted on Hover's infrastructure. However, no CMS or advanced frameworks are detected, indicating a lightweight custom build. Security posture is moderate; domain registration includes transfer and update prohibitions, but DNSSEC is not enabled and no security headers are present. Privacy compliance is low due to absence of privacy and cookie policies. Overall, the site is trustworthy and professional but could improve in security and compliance aspects.

F

Fangamer

fangamer.com

69

Fangamer operates a professional e-commerce website specializing in licensed video game merchandise including apparel, plushes, figures, books, and accessories. The site targets video game enthusiasts and collectors, positioning itself as a niche leader in this market segment. The business model is retail-focused, leveraging the Shopify platform for online sales and distribution. The website demonstrates strong branding consistency and excellent content quality, with clear navigation and mobile optimization.

S

SCS Software

worldoftrucks.com

63

World of Trucks is an online community platform operated by SCS Software that complements their popular truck simulation games, Euro Truck Simulator 2 and American Truck Simulator. The website serves as a hub for players to engage in community events, share content such as screenshots and videos, and stay updated with news and DLC releases. The platform targets simulation gaming enthusiasts and supports community-driven activities enhancing player engagement. Technically, the website is well-structured with modern web technologies, uses HTTPS exclusively, and integrates Google Analytics with privacy considerations such as IP anonymization. Media assets are hosted on Amazon S3, ensuring reliable content delivery. Security posture is solid with session protection and cookie consent mechanisms, though some security headers and explicit incident response policies are not publicly documented. The absence of WHOIS data is notable but does not detract from the site's legitimacy given the professional presentation and strong brand association with SCS Software. Overall, the site demonstrates a mature digital presence with good privacy compliance and user experience.

meow.company appears to be a small technology-focused website or personal project branded as "pancakes' corner of the internet." The site provides links to related services such as AodeRelay, Forgejo, and Iceshrimp.NET, indicating a community or developer-oriented ecosystem. The website is hosted on Debian GNU/Linux 12 in Melbourne, Australia, consistent with the domain registration data. The content is minimal but functional, with some ASCII art and basic system information displayed. There is no evidence of commercial activity or extensive business operations. The domain is newly registered in 2024, matching the apparent small scale and recent launch of the site.

The Starlight Network is a small, privacy-focused technology and community project operated by two individuals, Alexia and Nelson. The website serves as a platform for their blog posts, community engagement, and hosting of services that emphasize privacy, decentralization, and usability. The business model is community-supported, relying on donations via Liberapay, and targets technology enthusiasts interested in privacy and social interaction. The domain is newly registered in 2025 with protections to prevent unauthorized transfers or deletions, aligning with the privacy-centric ethos of the project. Technically, the website is built with basic HTML and CSS, with no detected CMS or advanced frameworks. The site is moderately optimized for performance and mobile use but lacks advanced SEO and accessibility features. No analytics or tracking scripts are present, indicating a minimal data collection approach. The hosting provider is not explicitly identified, but the domain registrar is Porkbun, known for privacy-friendly services. From a security perspective, the site lacks DNSSEC, security headers, and visible HTTPS enforcement details, which lowers its security posture. There is no published security policy or incident response information, and no cookie or privacy consent mechanisms are implemented. However, domain registration protections and the absence of suspicious content or vulnerabilities suggest a moderate security maturity level. Overall, the website is safe for general audiences, with no adult or questionable content detected. The site is professionally presented but could benefit from enhanced security measures, privacy compliance improvements, and clearer contact information to increase trust and credibility.

S

(un)Squeakable Code

squeakable.dev

55

The website squeakable.dev is a personal portfolio and blog site titled '(un)Squeakable Code'. It primarily serves as a space for the owner to share projects, blog posts, and links to related community sites. The content is minimal and informal, targeting a general audience interested in technology and personal projects. The site does not represent a commercial business entity and lacks formal business information or contact details. Technically, the site is a simple static HTML/CSS implementation without detectable CMS or advanced frameworks. There is no evidence of analytics, advertising, or tracking technologies. The site appears moderately optimized for mobile and accessibility but lacks advanced SEO features. No security headers or HTTPS status information was detected from the provided data, indicating potential areas for improvement in security posture. From a security perspective, the site does not provide privacy policies, cookie consent mechanisms, or incident response information. The WHOIS data is privacy protected, which is reasonable for a personal site. No vulnerabilities or suspicious patterns were identified, but the absence of security best practices and policies limits the overall security maturity. Overall, the site is low risk but would benefit from implementing HTTPS, security headers, privacy and cookie policies, and contact information to improve trust and compliance. The content is safe for general audiences with no adult or explicit material detected.