marketingapi.hellobike.com is a subdomain of Hello Bike, a well-known bike-sharing company. Our analysis found it's a working API endpoint with a five-year history and a clean security record, though it still supports older TLS versions that some security teams prefer to disable. The site has an about page and legal disclosures, which is a good sign for a backend service. However, it lacks common security headers like content security policy and HTTP strict transport security, which are worth checking if you're integrating this API. While there are no red flags that suggest a scam, the infrastructure gaps mean it's not a top-tier setup. If you're a developer, verify the endpoint's security configuration before sending sensitive data. For most users, marketingapi.hellobike.com appears to be a legitimate part of the Hello Bike ecosystem.
Yes — marketingapi.hellobike.com looks mostly safe
In plain English
This is the marketing API subdomain of Hello Bike, a legitimate bike-sharing service. While the site is technically sound with valid encryption and a clean reputation, the presence of outdated TLS versions and missing security headers are minor concerns for an API endpoint. Overall, it appears to be a legitimate backend service, not a scam.
Where the score comes from
The site uses modern TLS 1.3 and a valid certificate from DigiCert, but it still accepts outdated TLS 1.0 and 1.1, which is a minor vulnerability for an API endpoint. No security headers are set, leaving the connection less protected against common web attacks.
This is a subdomain of hellobike.com, a known bike-sharing brand. The main domain's WHOIS isn't exposed here, but the presence of a business disclosure page and about page shows the operator is willing to identify themselves.
Clean DNS blacklists, no Google Web Risk threats, and a five-year web archive history show this API has been around without major issues. The lack of a Tranco rank is normal for an API subdomain.
An about page and a legal entity disclosure are present, which is good for a backend service. However, no contact information is visible on the homepage (which is a JSON error page), and there are no social media links — acceptable for an API but not ideal.
Privacy policy and terms of service are both available, meeting basic legal expectations for a commercial service. The site appears to be operated by a registered business, as indicated by the business disclosure page.
The site is hosted on Alibaba Cloud in China, which is consistent with a Chinese company. DNSSEC is not enabled, and the sitemap is misconfigured. No email handling (no MX records) is expected for an API endpoint, but the missing security headers are a notable gap.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →