I checked some of it, did they just run nikto against some russian IPs?

Their “vulnerabilities” are mostly clickjacking missing headers and secure flags on cookies (probably not even session cookies)