Inmobi Domain Security

generated: '2026-08-12'
method: probed
source: >-
  live DNS/TLS/HTTP probes of every host named in apis.yml, 2026-08-12
  (probe-domain-security.py output extended by hand to cover the three API hosts
  the script does not read: publisher.inmobi.com, api.cdr.inmobi.com and
  api.w.inmobi.com)
notes: >-
  The finding worth carrying forward: InMobi's API hosts are hardened but its
  PUBLIC-FACING hosts are not. api.inmobi.com, publisher.inmobi.com and
  api.cdr.inmobi.com all return Strict-Transport-Security with includeSubDomains
  on their API paths, while www.inmobi.com — the host the brand, the Trust
  Center and every policy document live on — serves no HSTS header at all. The
  domain has no DNSSEC and no CAA record, so certificate issuance for
  inmobi.com is unconstrained. Email authentication is the strongest part of the
  posture: SPF ends in a hard fail and DMARC is at p=quarantine with 100%
  coverage, aggregate and forensic reporting, and an explicit subdomain policy.
hosts:
- host: www.inmobi.com
  role: corporate site
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  4 23:59:59 2026 GMT
  hsts: false
  note: No Strict-Transport-Security header on the primary brand host.
- host: support.inmobi.com
  role: documentation
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 12 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.inmobi.com
  role: Publisher Reporting API
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 22 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 15552000
  hsts_include_subdomains: true
  note: >-
    The root path 302-redirects to a blackhole and returns no HSTS; the header
    is present on the routed API path /v3.0/reporting/publisher.
  other_headers:
    x-content-type-options: nosniff
    x-frame-options: SAMEORIGIN
    x-xss-protection: 1; mode=block
    x-dns-prefetch-control: 'off'
    x-download-options: noopen
- host: publisher.inmobi.com
  role: Ad Management API + publisher dashboard
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  4 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 15552000
  hsts_include_subdomains: true
- host: api.cdr.inmobi.com
  role: DSP Cost API
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 20 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: api.w.inmobi.com
  role: Server-to-Server Ad Request API
  https: true
  tls_version: TLSv1.3
  cert_expires: Feb  9 23:59:59 2027 GMT
  hsts: false
- host: advertising.inmobi.com
  role: advertiser marketing site
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  4 23:59:59 2026 GMT
  hsts: false
domains:
- domain: inmobi.com
  dnssec: false
  caa: []
  caa_note: No CAA record — any public CA may issue for inmobi.com.
  spf: true
  spf_policy: '-all (hard fail)'
  spf_record: 'v=spf1 ip4:50.213.20.161 ip4:209.214.228.18 ip4:101.254.125.194 ip4:123.127.0.146 include:_s00230767.autospf.email include:outbound.mailhop.org include:2714195.spf01.hubspotemail.net -all'
  dmarc: true
  dmarc_policy: quarantine
  dmarc_pct: 100
  dmarc_subdomain_policy: quarantine
  dmarc_rua: dmarc-report@inmobi.com
  dmarc_ruf: dmarc-report@inmobi.com
security_txt:
  published: false
  probed: 6 hosts, 2026-08-12
  see: well-known/inmobi-well-known.yml
vulnerability_disclosure:
  published: false
  probes:
  - {url: 'https://www.inmobi.com/.well-known/security.txt', status: 404}
  - {url: 'https://www.inmobi.com/security/', status: 200, result: 'security page served but publishes no disclosure policy, contact, or PGP key'}
  - {url: 'https://hackerone.com/inmobi', status: 404}
  - {url: 'https://bugcrowd.com/inmobi', status: 404}
  checked: '2026-08-12'
  note: >-
    probe-security-programs.py reported vdp=none on 2026-08-12 and wrote no
    vulnerability-disclosure artifact, which is the correct outcome. No
    VulnerabilityDisclosure or SecurityTxt pointer is emitted in apis.yml.