raven-us.didiglobal.com is a subdomain of Didi Global, the ride-hailing giant. That parent brand gives it some baseline credibility, but the subdomain itself acts more like an internal API or infrastructure endpoint than a public-facing site. The homepage returns a simple status code with no customer-facing content. When evaluating whether raven-us.didiglobal.com is a scam or safe to use, consider what it reveals about security: the server still accepts outdated TLS 1.0 and 1.1, and the SSL certificate is valid for less than a month. For any infrastructure service handling data, those are real concerns. The domain also blocks all search crawlers and lacks common security headers — both unusual for a transparently operated service. While no malware or blacklist flags were found, the missing contact information and lack of a web history make it hard to fully trust that this endpoint is maintained with the same rigor as Didi's main consumer services. If you're using this subdomain for development or internal tools, check with the parent company directly about its purpose and support channels.
Not sure — double-check raven-us.didiglobal.com first
In plain English
This site is a subdomain of the large transportation company Didi Global, but it has some technical shortcomings that give pause. The accepting of outdated encryption and an expiring certificate suggest the security setup isn't being actively maintained. If you're using this endpoint for anything sensitive, it's worth verifying the operator's contact info before going further.
Where the score comes from
The site uses modern TLS but also accepts outdated, vulnerable encryption protocols. The SSL certificate expires in less than a month, which is a red flag for any service that handles data over the internet.
The subdomain belongs to Didi Global, a known company, but no contact information appears on the homepage and there's no social media presence. The business disclosure and about page are present, but the ownership of this specific subdomain isn't clearly communicated.
No blacklist flags or Google Web Risk threats. The site is too new to have a web archive history, which is neutral for an internal or API endpoint.
An about page and a business disclosure page exist, but the lack of direct contact info or social links makes it harder to verify who runs this specific subdomain.
Privacy policy and terms of service are available. For an infrastructure service, these legal pages meet the baseline, though cookie consent isn't visible.
The server doesn't set common security headers, blocks all search crawlers, and has a misconfigured sitemap. No DNSSEC or email handling, which is below standard for a business-run service.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →