generated: '2026-08-25'
method: probed
source: live DNS/TLS/HTTP probes of the Mobile Premier League consumer + API hosts
note: >-
  www.mplgames.com is the live consumer surface; www.mpl.live is the legacy India surface and
  api.mpl.live is the app-facing gateway (returns JSON 404s to every unauthenticated path).
  Both apex domains were probed even though only mplgames.com is wired as a pointer in apis.yml.
hosts:
- host: www.mplgames.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov  9 13:57:52 2026 GMT
  hsts: false
- host: www.mpl.live
  https: true
  hsts: false
- host: api.mpl.live
  https: true
  hsts: false
domains:
- domain: mplgames.com
  dnssec: false
  caa: []
  spf: false
  dmarc: false
- domain: mpl.live
  dnssec: false
  caa: []
  spf: true
  spf_record: v=spf1 include:_spf.google.com ~all
  dmarc: false
findings:
- id: no-dmarc
  severity: medium
  detail: Neither mplgames.com nor mpl.live publishes a _dmarc TXT record.
- id: no-spf-mplgames
  severity: medium
  detail: mplgames.com publishes no SPF record; mpl.live publishes v=spf1 include:_spf.google.com ~all.
- id: no-caa
  severity: low
  detail: No CAA records on either apex domain.
- id: no-hsts
  severity: low
  detail: No Strict-Transport-Security header on www.mplgames.com, www.mpl.live or api.mpl.live.
- id: dangling-cname
  severity: high
  detail: >-
    developer.mpl.live is a CNAME to
    dualstack.prod-developer-dashboard-2060818981.ap-south-1.elb.amazonaws.com, which itself
    returns NXDOMAIN. The record points at a deleted AWS load balancer — the classic
    subdomain-takeover shape. Reported here as an observed DNS fact, not as an exploit.