Skip to main content

Is asp-construction.org a Scam? Security Check Results - ASP Construction Reviews

asp-construction.org favicon

Is asp-construction.org Safe? Security Analysis for ASP Construction

https://asp-construction.org

Check if asp-construction.org is a scam or legitimate. Free security scan and reviews.

EducationCanadamedium
Joomla CMSGoogle AnalyticsGoogle reCAPTCHAMooTools JavaScript frameworkGoogle Maps API+1 more
Analyzed 10/4/2025Completed 3:32:27 AM
48
Security Score
HIGH RISK

AI Summary

ASP Construction is a well-established non-profit organization based in Quebec, Canada, specializing in health and safety training and resources for the construction industry. The website serves as a comprehensive portal offering mandatory safety courses, publications, and documentation to workers, employers, and associations. The organization maintains a strong market position as a trusted provider of construction safety education, supported by a mature domain and consistent branding. Technically, the website is built on Joomla CMS and integrates modern tools such as Google Analytics, Google reCAPTCHA, and CookieFirst for consent management. The site is mobile-optimized with good navigation and SEO practices, although some improvements in accessibility and security headers could enhance its posture. The domain is secured with HTTPS and registrar locks, but DNSSEC is not enabled. Security-wise, the site follows best practices including HTTPS enforcement and CAPTCHA protection on forms. However, the absence of DNSSEC and Content-Security-Policy headers are areas for improvement. No critical vulnerabilities or exposed sensitive data were detected. Privacy compliance is strong with clear privacy and cookie policies and consent mechanisms in place. Overall, ASP Construction's website demonstrates a solid security posture and professional digital presence, supporting its credibility and trustworthiness. Strategic enhancements in security headers and DNS security would further strengthen its defenses.

Detected Technologies

Joomla CMSGoogle AnalyticsGoogle reCAPTCHAMooTools JavaScript frameworkGoogle Maps APICookieFirst consent management

🧠AI Business Intelligence

Technology stack, business insights, and market analysis powered by AI.

Business Intelligence

Market & Strategic Analysis

ASP Construction operates in the education and non-profit sectors, focusing on construction health and safety in Quebec. Its business model relies on employer contributions via CNESST, offering free publications to contributing employers and mandatory training to workers. The organization targets construction workers, employers, and associations, providing multiple portals and extensive resources. The website reflects a mature operation with a long domain history and consistent branding. Partnerships with government-related entities like CNESST and the documentation center enhance its ecosystem. The presence on social media platforms like Facebook and LinkedIn supports outreach and engagement. The organization's market position is strong within its niche, with clear growth indicators through training offerings and publications.

Extracted Contact Information

Marketing Intelligence Data

Phone Numbers (2)

514*******
180*******

Security Posture Analysis

Comprehensive Security Assessment

The website exhibits a good security maturity level with HTTPS enabled and use of Google reCAPTCHA to protect forms from automated abuse. Cookie consent is managed via CookieFirst, indicating awareness of privacy regulations. The domain is protected with registrar locks preventing unauthorized transfers or deletions. However, the lack of DNSSEC implementation and missing Content-Security-Policy headers represent gaps that could be exploited in DNS spoofing or cross-site scripting attacks. No exposed credentials or sensitive data were found in the HTML content. The site uses modern JavaScript libraries and frameworks but should ensure all components are regularly updated to mitigate vulnerabilities. Incident response and security policy pages are not explicitly found, suggesting room for improvement in transparency and readiness.

Strategic Recommendations

Priority Actions for Security Improvement

1

Enable DNSSEC on the domain to enhance DNS security and prevent spoofing.

Observations

AI-powered comprehensive website and business analysis.

AI-Enhanced Website Analysis

Business Insights

Company:

ASP Construction

Description:

ASP Construction is a non-profit organization focused on health and safety training and resources for the construction sector in Quebec, Canada. They provide mandatory safety courses, publications, and documentation to workers and employers in the construction industry.

Key Services:
Mandatory 30-hour safety courseHealth and safety publicationsTraining calendar and registrationDocumentation centerOnline portals for workers, employers, and associations
Content Quality:

good

Branding:

consistent

Technical Stack

Technologies:
Joomla CMSGoogle AnalyticsGoogle reCAPTCHAMooTools JavaScript frameworkGoogle Maps APICookieFirst consent management
Frameworks:
Joomla
Platforms:
Web
Performance:

moderate

Mobile:

good

Accessibility:

basic

SEO:

good

Security Assessment

Security Score:
75/100
Best Practices:
  • HTTPS enforced
  • Use of Google reCAPTCHA on forms
  • Cookie consent mechanism implemented
  • No exposed sensitive data found in HTML

Analytics & Tracking

Services:
Google Analytics
Tracking Level:moderate
Privacy Compliance:good

Advertising & Marketing

Marketing Tools:
CookieFirst
Transparency Level:basic

Website Quality Assessment

Design Quality:good
User Experience:good
Content Relevance:good
Navigation Clarity:good
Professionalism:good
Trustworthiness:high

Key Observations

1

Website is fully accessible with no blocking or WAF challenges.

🛡️Security Headers

HTTP security headers analysis and recommendations.

Security Headers

HTTP security headers analysis

40/100
Score

Missing Strict-Transport-Security header

HIGH

Forces HTTPS connections

Missing X-Frame-Options header

HIGH

Prevents clickjacking attacks

Missing Content-Security-Policy header

HIGH

Controls resources the browser is allowed to load

Missing Referrer-Policy header

LOW

Controls referrer information sent with requests

Missing Permissions-Policy header

MEDIUM

Controls browser features and APIs

👤GDPR Compliance

Privacy and data protection assessment under GDPR regulations.

GDPR Compliance

Privacy and data protection assessment

35/100
Score

No Privacy Policy found

HIGH

GDPR requires a clear and accessible privacy policy

No Cookie Policy found

HIGH

GDPR requires clear information about cookie usage

No Cookie Consent Banner found

HIGH

GDPR requires explicit consent for non-essential cookies

Third-party services without privacy policy

HIGH

Detected services: Google Analytics, Facebook, LinkedIn, Google APIs

GDPR Compliance Analysis

Privacy Policy0% confidence
Cookie Policy0% confidence
Contact Information Found90% confidence
phone

🛡️NIS2 Compliance

Network & Information Security Directive compliance assessment.

NIS2 Compliance

Network & Information Security Directive

17/100
Score

No information security framework found

HIGH

NIS2 requires documented cybersecurity and information security measures

No vulnerability disclosure policy

MEDIUM

NIS2 encourages coordinated vulnerability disclosure

No security policy documentation found

HIGH

NIS2 requires documented cybersecurity governance and risk management

No incident response procedures found

HIGH

NIS2 requires documented incident response and business continuity plans

No business continuity planning found

MEDIUM

NIS2 emphasizes operational resilience and business continuity

No security contact information

HIGH

NIS2 requires clear incident reporting channels

No vulnerability reporting mechanism

MEDIUM

Clear vulnerability reporting supports coordinated disclosure

No NIS2 reference found

LOW

Consider explicitly mentioning NIS2 compliance efforts

📧Email Security

SPF, DKIM, and DMARC validation and email security assessment.

Email Security

SPF, DKIM, and DMARC validation

70/100
Score

DMARC not enforcing

MEDIUM

DMARC policy is set to "none"

No DMARC reporting

LOW

DMARC aggregate reports not configured

No BIMI Record

LOW

BIMI displays brand logos in email clients

No MTA-STS Policy

MEDIUM

MTA-STS enforces TLS for email delivery

No TLS-RPT Record

LOW

TLS-RPT provides reporting for email TLS issues

SPF
Sender Policy Framework
DKIM
DomainKeys Identified Mail
DMARC
Domain-based Message Authentication
MX Records
Mail Exchange Records
BIMI
Brand Indicators
MTA-STS
Mail Transfer Agent Security
TLS-RPT
TLS Reporting
DNSSEC
DNS Security
SPF Details
Record:
v=spf1 a mx include:spf.protection.outlook.com ip4:104.47.75.228/32 ip4:104.47.75.164/32 a:dispatch-us.ppe-hosted.com a:envoit.loisirsport.net ip4:206.167.20.44/24 ip4:158.85.77.121 ip4:158.69.254.184 ip4:158.85.89.116 ip4:158.85.77.121 ip4:51.222.151.191 ip4:52.233.19.110 ~all
DNS Lookups:5/10
Policy:~all
DKIM Selectors Found
Selector:k2(1416-bit rsa)
DMARC Details
Policy:none

🏆SSL/TLS Security

Certificate validity and encryption analysis.

SSL/TLS Security

Certificate validity and encryption analysis

62/100
Score

Weak Protocols Supported

HIGH

Server supports weak protocols: TLSv1.1

OCSP Stapling Not Enabled

LOW

OCSP stapling improves performance and privacy

Certificate Transparency Not Implemented

LOW

Certificate is not logged in Certificate Transparency logs

SSL Certificate Expires Within 90 Days

MEDIUM

SSL certificate expires in 74 days

Mixed Content Detected

MEDIUM

2 resources loaded over insecure HTTP

Partial SSL/TLS Assessment

LOW

Completed 3 of 4 security checks due to time constraints

Protocol Support

TLSv1.3TLSv1.2TLSv1.1

OCSP Status

OCSP Stapling Disabled

📊DNS Health

DNS configuration and security assessment.

DNS Health

DNS configuration and security assessment

80/100
Score

DNSSEC Not Enabled

MEDIUM

DNSSEC is not configured for this domain

CAA Records Not Configured

LOW

Certificate Authority Authorization (CAA) records not found

DMARC Policy Set to None

LOW

DMARC is configured but not enforcing any policy

Domain Registration Details

Domain Age
28 years(mature)
Expiry Risk
none(1648 days)
Protection Level
strongDNSSEC OFF

DNS Records

A Records:51.222.151.191
Name Servers:
ns07.domaincontrol.com
ns08.domaincontrol.com
MX Records:
20: mx2-us1.ppe-hosted.com
10: mx1-us1.ppe-hosted.com
SOA:Serial: 2025100300, TTL: 600s

DNSSEC Status

DNSSEC Not Enabled

DNS Performance

Resolution Time:346ms

SPF Analysis

SPF Record:
v=spf1 a mx include:spf.protection.outlook.com ip4:104.47.75.228/32 ip4:104.47.75.164/32 a:dispatch-us.ppe-hosted.com a:envoit.loisirsport.net ip4:206.167.20.44/24 ip4:158.85.77.121 ip4:158.69.254.184 ip4:158.85.89.116 ip4:158.85.77.121 ip4:51.222.151.191 ip4:52.233.19.110 ~all

Network Security

Port scanning and network exposure analysis.

Network Security

Port scanning and network exposure analysis

0/100
Score

High-Risk Service Exposed: FTP

HIGH

Port 21 (FTP) is publicly accessible - FTP - Often unencrypted file transfer

Critical Service Exposed: MySQL

CRITICAL

Port 3306 (MySQL) is publicly accessible - MySQL - Database server

🔧Technical Analysis

Detailed technical findings and analysis from AI assessment.

Technical Analysis

Comprehensive security assessment findings

Additional Findings

The website is powered by Joomla CMS, leveraging MooTools JavaScript framework and Google services including Analytics and Maps API. CookieFirst is used for cookie consent management. The site loads asynchronously many scripts to optimize performance but could benefit from further optimization for speed. Mobile optimization is good with responsive menus and layouts. SEO is supported by proper meta tags and Open Graph data. Hosting appears stable with GoDaddy as registrar, though hosting provider details are not explicit. The site lacks DNSSEC and some security headers, which are technical risks. Overall, the infrastructure is solid but could be modernized with enhanced security headers and performance tuning.
⭐ Verified Community Reviews

What others say about asp-construction.org

Share your experience to help others make informed decisions. We verify every review by email and publish it once our moderation team approves it.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

out of 5

0 reviews published

Loading reviews…

How did we do?

Your feedback directly shapes our roadmap. Rate the quality of this report, leave an optional comment, and let us know if you want our security specialists to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.

Analyze Another Website