ws.api.cnyes.com is a subdomain that serves a default OpenResty landing page — it's not a store, a blog, or a service you'd sign up for. This is a technical endpoint, likely part of a larger API infrastructure. For a site of this type, the absence of contact information, about pages, and legal documents is completely normal. You wouldn't expect a privacy policy on a server that just shows a welcome message. What matters more is that the domain has been active for at least six years, has a clean security record, and is hosted on Google Cloud. There are no signs of scams or malware. The only minor concern is that the server still accepts outdated TLS 1.0 and 1.1 connections, which is a security best practice to disable. But for a simple API endpoint, it's not a critical risk. If you're looking for a consumer-facing business, this isn't one. If you're integrating with a cnyes.com API, the longevity and clean history are reassuring. There's no evidence to suggest ws.api.cnyes.com is fake or dangerous, but there's also little to confirm who runs it — that's typical for infrastructure like this. Trust the parent domain's reputation if you have one, and treat this as a neutral technical service.
In plain English
This isn't a consumer website — it's a technical API endpoint showing a default OpenResty welcome page. The lack of contact info, legal pages, and branding is normal for this kind of server. There's no evidence of malicious activity, and the domain has been around for years. If you're just interacting with an API, there's no reason for alarm, but you won't find a company to call or a privacy policy to read.
Where the score comes from
The site uses a valid certificate and modern TLS 1.3, but it still accepts older, insecure TLS versions. That's a minor gap for a technical endpoint, not a dealbreaker.
There's virtually no information about who runs this site. The WHOIS record for the subdomain is empty, and there's no company name or ownership disclosure. For an API endpoint, some anonymity is normal, but it still leaves you in the dark.
Clean blacklists and a six-year web archive history show this domain has been around for a while without any reported abuse. That's a solid track record.
No contact page, no about page, no social media. For a public API endpoint, it's common to have minimal public-facing information, but it also means you can't easily reach anyone if something goes wrong.
Missing privacy policy and terms of service are expected for a technical endpoint that doesn't collect user data. There's no legal requirement here, so this isn't a red flag.
The server runs on Google Cloud, which is a reputable provider. The site loads quickly, but it lacks basic security headers and DNSSEC. For a simple API endpoint, that's acceptable but not best practice.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →