generated: '2026-08-26'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.mthreads.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Mar 14 23:59:59 2027 GMT
  hsts: true
  hsts_max_age: 15724800
- host: docs.mthreads.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Mar 14 23:59:59 2027 GMT
  hsts: true
  hsts_max_age: 15724800
- host: aibook-api.mthreads.com
  https: false
  note: >-
    Port 443 is closed on this host. The AIBook APIs are served on non-standard high ports
    (32414 TTS, 62220 ASR, 32314 voice conversion), each probed separately below.
- host: 'aibook-api.mthreads.com:32414'
  https: true
  tls_version: TLSv1.2
  cert_valid: true
  hsts: false
  note: TTS. Handshake completes and the certificate chain validates; probes from the United States intermittently time out mid-handshake.
- host: 'aibook-api.mthreads.com:62220'
  https: true
  tls_version: TLSv1.2
  cert_valid: true
  hsts: false
  note: ASR. Verified with an unauthenticated request returning HTTP 400 over a validated TLS 1.2 channel (ECDHE-RSA-AES128-GCM-SHA256).
- host: 'aibook-api.mthreads.com:32314'
  https: true
  tls_version: TLSv1.2
  cert_valid: true
  hsts: false
  note: Streaming voice conversion.
- host: coding-plan-endpoint.kuaecloud.net
  https: true
  cert_valid: true
  hsts: false
  note: >-
    KUAE Cloud Coding Plan inference endpoint. Fronted by a Volcengine ALB
    (alb-xohaibke0f7k54ov5eie2tco.cn-beijing.volcenginealb.com). No Strict-Transport-Security
    header is returned, unlike the mthreads.com web hosts which set max-age=15724800.
domains:
- domain: kuaecloud.net
  dnssec: false
  caa: []
  spf: false
  dmarc: false
  note: >-
    The KUAE Cloud API domain carries no SPF, no DMARC, no CAA and no DNSSEC — weaker than the
    mthreads.com corporate domain, which at least publishes SPF.
- domain: mthreads.com
  dnssec: false
  caa: []
  spf: true
  dmarc: false
findings:
- The three AIBook API listeners run TLS 1.2 with no HSTS, while the marketing hosts run TLS 1.3 with HSTS — the API surface is the weaker half of the estate.
- No host on either domain publishes CAA records, so any public CA may issue for mthreads.com or kuaecloud.net.
- DNSSEC is unsigned on both domains and DMARC is absent on both.
checked: '2026-08-26'