Is zhuiwan.org Safe? Security Analysis for 上海追万网络科技有限公司
Check if zhuiwan.org is a scam or legitimate. Free security scan and reviews.
AI Summary
上海追万网络科技有限公司是一家专注于软件定制开发的专业技术公司，拥有超过15年的行业经验，提供包括APP开发、软件定制开发、微信小程序开发、网站建设及UI/UX设计等多样化服务。公司拥有12项软件著作权，体现了其强大的自主研发能力和技术创新实力。网站内容丰富，面向企业客户，致力于为客户提供高质量、个性化的软件解决方案。技术栈涵盖主流前端框架和库，网站设计专业且移动优化良好。安全方面，网站使用HTTPS，但缺少安全头部配置和隐私合规声明，存在改进空间。WHOIS信息缺失，影响域名信任度评估。整体来看，网站专业度较高，适合目标客户群体，建议加强隐私合规和安全防护措施以提升整体安全和合规水平。
Detected Technologies
🧠AI Business Intelligence
Technology stack, business insights, and market analysis powered by AI.
Business Intelligence
Market & Strategic Analysis
该公司在中国上海市场定位为中型软件定制开发服务商，凭借多年经验和多项软件著作权建立了较强的市场竞争力。其业务模式以定制开发为核心，涵盖移动应用、企业管理系统及网站建设等，目标客户为需要数字化转型的企业。网站展示了丰富的客户案例和合作伙伴，表明其在行业内有一定的合作网络。营销策略依赖于内容丰富的资讯和案例展示，结合电话和在线预约等多渠道客户接触方式。缺乏公开的隐私政策和安全响应机制，可能影响部分客户的信任感。未来可通过完善合规体系和强化安全措施提升市场竞争力。
Extracted Contact Information
Marketing Intelligence Data
Email Addresses (1)
Phone Numbers (2)
Physical Addresses (1)
Security Posture Analysis
Comprehensive Security Assessment
网站采用HTTPS保障数据传输安全，但未检测到常见安全头部如Content-Security-Policy、X-Frame-Options等，存在潜在的安全风险。表单输入有基础验证，但缺少高级防护措施如验证码或反机器人机制。未发现敏感信息泄露或明显漏洞。缺少公开的安全政策和事件响应联系方式，表明安全管理体系尚不完善。建议加强安全头部配置，完善隐私和安全政策披露，提升安全事件响应能力，以增强客户信任和合规性。
Strategic Recommendations
Priority Actions for Security Improvement
部署并配置安全HTTP头部（如CSP、HSTS、X-Frame-Options）以防范常见攻击。
✨Observations
AI-powered comprehensive website and business analysis.
AI-Enhanced Website Analysis
Business Insights
上海追万网络科技有限公司
上海追万软件是一家专业的软件定制开发公司，提供包括上海软件定制开发、企业软件定制开发、软件定制开发等多种软件定制服务，致力于为客户提供高质量的定制开发服务，满足客户个性化需求。
good
consistent
Technical Stack
moderate
good
basic
good
Security Assessment
- HTTPS usage implied by URL
- No exposed sensitive data in HTML
- Form inputs with basic validation
Analytics & Tracking
Advertising & Marketing
Website Quality Assessment
Key Observations
Website is fully accessible with rich content in Chinese language.
🛡️Security Headers
HTTP security headers analysis and recommendations.
Security Headers
HTTP security headers analysis
Missing X-Content-Type-Options header
MEDIUMPrevents MIME type sniffing
Missing Content-Security-Policy header
HIGHControls resources the browser is allowed to load
Missing X-XSS-Protection header
MEDIUMLegacy XSS protection (deprecated but still recommended)
Missing Referrer-Policy header
LOWControls referrer information sent with requests
Missing Permissions-Policy header
MEDIUMControls browser features and APIs
👤GDPR Compliance
Privacy and data protection assessment under GDPR regulations.
GDPR Compliance
Privacy and data protection assessment
No Privacy Policy found
HIGHGDPR requires a clear and accessible privacy policy
No Cookie Policy found
HIGHGDPR requires clear information about cookie usage
No Cookie Consent Banner found
HIGHGDPR requires explicit consent for non-essential cookies
GDPR Compliance Analysis
🛡️NIS2 Compliance
Network & Information Security Directive compliance assessment.
NIS2 Compliance
Network & Information Security Directive
No vulnerability disclosure policy
MEDIUMNIS2 encourages coordinated vulnerability disclosure
No incident response procedures found
HIGHNIS2 requires documented incident response and business continuity plans
No business continuity planning found
MEDIUMNIS2 emphasizes operational resilience and business continuity
No security contact information
HIGHNIS2 requires clear incident reporting channels
No vulnerability reporting mechanism
MEDIUMClear vulnerability reporting supports coordinated disclosure
No NIS2 reference found
LOWConsider explicitly mentioning NIS2 compliance efforts
📧Email Security
SPF, DKIM, and DMARC validation and email security assessment.
Email Security
SPF, DKIM, and DMARC validation
No SPF record found
HIGHSPF helps prevent email spoofing
No DKIM record found
MEDIUMDKIM adds cryptographic signatures to emails
No BIMI Record
LOWBIMI displays brand logos in email clients
No MTA-STS Policy
MEDIUMMTA-STS enforces TLS for email delivery
No TLS-RPT Record
LOWTLS-RPT provides reporting for email TLS issues
No email authentication configured
CRITICALDomain is vulnerable to email spoofing
🏆SSL/TLS Security
Certificate validity and encryption analysis.
SSL/TLS Security
Certificate validity and encryption analysis
Weak Protocols Supported
HIGHServer supports weak protocols: TLSv1.1
OCSP Stapling Not Enabled
LOWOCSP stapling improves performance and privacy
Certificate Transparency Not Implemented
LOWCertificate is not logged in Certificate Transparency logs
Mixed Content Detected
MEDIUM16 resources loaded over insecure HTTP
Partial SSL/TLS Assessment
LOWCompleted 3 of 4 security checks due to time constraints
Protocol Support
OCSP Status
📊DNS Health
DNS configuration and security assessment.
DNS Health
DNS configuration and security assessment
DNSSEC Not Enabled
MEDIUMDNSSEC is not configured for this domain
CAA Records Not Configured
LOWCertificate Authority Authorization (CAA) records not found
Domain Transfer Lock Not Enabled
MEDIUMDomain can be transferred without authorization
Domain Delete Lock Not Enabled
LOWDomain can be deleted without additional verification
No DMARC Record
MEDIUMDMARC policy not configured
Domain Registration Details
- •No domain protection locks enabled
DNS Records
DNSSEC Status
DNS Performance
⚡Network Security
Port scanning and network exposure analysis.
Network Security
Port scanning and network exposure analysis
High-Risk Service Exposed: FTP
HIGHPort 21 (FTP) is publicly accessible - FTP - Often unencrypted file transfer
Service Exposed: SSH
MEDIUMPort 22 (SSH) is publicly accessible - SSH - Secure but can be brute-forced
🔧Technical Analysis
Detailed technical findings and analysis from AI assessment.
Technical Analysis
Comprehensive security assessment findings