When you encounter an API endpoint like supportapi-prod.codebig2.net, the first question is whether you can trust it with your authentication credentials. Legitimate API services typically provide a developer portal, company information, and clear terms of use. This site offers none of that. The domain is essentially invisible: no WHOIS record, no about page, no social media presence, and a bot protection system that blocks any attempt to learn more. The SSL certificate is valid and the connection is encrypted, but that only covers the transport layer, not the organization behind it. For a service that expects you to send credentials, the lack of transparency is a significant warning sign. Most professional API providers have a verifiable company name, support channels, and a history you can research. Here, you have nothing to go on. If you are considering using this API, we strongly recommend finding an alternative with a clear public identity and documented compliance practices. Trust should be earned, not assumed when the operator remains hidden.
No — supportapi-prod.codebig2.net doesn't look safe
In plain English
This site raises serious concerns. It's an API endpoint that requires authentication, yet there is no public information about who runs it, no contact details, and no legal terms. The technical security is fine, but the complete lack of transparency makes it hard to trust with any credentials or data.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site uses modern encryption and a valid certificate with a reputable issuer, and no malware or phishing flags appear. That's the one area where it meets expectations for a technical service.
There is zero public information about who operates this site: no WHOIS record, no company page, no branding. For an API that requires authentication, this level of anonymity is a serious red flag.
The site hasn't been blacklisted, but it has no web archive history, no traffic rank, and no external reviews. It's essentially a blank slate with no track record to judge by.
No contact details, no about page, no social media presence, and bot protection stopped us from seeing any further. The site is completely opaque about who is behind it.
For a commercial API service, you'd expect legal terms like a privacy policy and terms of service. None were found, and the site's bot protection blocked any attempt to check. That's a significant gap.
The hosting is on a residential-grade ISP network (Comcast), which is unusual for a production API. DNSSEC is not enabled, and the server name is generic. It works, but it doesn't inspire confidence.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.