Bug bounty program · HackerOne
Most upvoted reports4
- #1482919ValidMisconfigured rate limit for SMS phone verification endpointAlohi · Input Validation and Logic · 2022–26votes
- #1472394ValidMisconfigured rate limit at app.sign.plus/forgot_passwordAlohi · Input Validation and Logic · 2022–25votes
- #1494308ValidWaitlist bypass for accessing SIGN.PLUS BetaAlohi · Access Control · 2022–11votes
- #1584569ValidWeak rate limit for SIGN.PLUS email verificationAlohi · No weakness recorded · 2022–3votes
Subdomains88
62 covered by the program's own scope · 0 first seen this week
88 names
| Name | Scope | First seen |
|---|---|---|
| affiliate.alohi.com | Not in the scope | 2026-11-14 |
| mail.app.alohi.commail | Not in the scope | 2026-11-14 |
| in.mail.app.alohi.commail | Not in the scope | 2026-11-14 |
| cookie-pro.alohi.com | Not in the scope | 2026-11-14 |
| de.alohi.com | Not in the scope | 2026-11-14 |
| en.alohi.com | Not in the scope | 2026-11-14 |
| eu.alohi.com | Not in the scope | 2026-11-14 |
| cc.eu.alohi.com | Not in the scope | 2026-11-14 |
| storage.eu.alohi.com | Not in the scope | 2026-11-14 |
| fr.alohi.com | Not in the scope | 2026-11-14 |
| help.alohi.com | Not in the scope | 2026-11-14 |
| id.alohi.com | Not in the scope | 2026-11-14 |
| ja.alohi.com | Not in the scope | 2026-11-14 |
| join.alohi.com | Not in the scope | 2026-11-14 |
| mail1.alohi.commail | Not in the scope | 2026-11-14 |
| nullmx.alohi.com | Not in the scope | 2026-11-14 |
| ref.alohi.com | Not in the scope | 2026-11-14 |
| sales.alohi.com | Not in the scope | 2026-11-14 |
| sso.alohi.comauth | Not in the scope | 2026-11-14 |
| staging.alohi.comstaging | Not in the scope | 2026-11-14 |
| status.alohi.commonitoring | Not in the scope | 2026-11-14 |
| support.alohi.com | Not in the scope | 2026-11-14 |
| trust.alohi.com | Not in the scope | 2026-11-14 |
| wildcard.alohi.com | Not in the scope | 2026-11-14 |
| www.alohi.com | In scope | 2026-11-14 |
| nullmx.www.alohi.com | Not in the scope | 2026-11-14 |
| wwwbeta.alohi.com | Not in the scope | 2026-11-14 |
| accounts.fax.plus | In scope | 2026-11-14 |
| admin.fax.plusadmin | In scope | 2026-11-14 |
| affiliate.fax.plus | In scope | 2026-11-14 |
| api.fax.plusapi | In scope | 2026-11-14 |
| apidoc.fax.plus | In scope | 2026-11-14 |
| app.fax.plus | In scope | 2026-11-14 |
| beta.fax.plusstaging | In scope | 2026-11-14 |
| blog.fax.plus | In scope | 2026-11-14 |
| en.fax.plus | In scope | 2026-11-14 |
| eshop.fax.plus | In scope | 2026-11-14 |
| fax-mongo-analytics.fax.plusdata | In scope | 2026-11-14 |
| geolocation.fax.plus | In scope | 2026-11-14 |
| help.fax.plus | In scope | 2026-11-14 |
| m.fax.plus | In scope | 2026-11-14 |
| mail.fax.plusmail | In scope | 2026-11-14 |
| backup.mail.fax.plusdata, mail | In scope | 2026-11-14 |
| in.mail.fax.plusmail | In scope | 2026-11-14 |
| mail1.fax.plusmail | In scope | 2026-11-14 |
| mongo.fax.plusdata | In scope | 2026-11-14 |
| mongo1.fax.plusdata | In scope | 2026-11-14 |
| zrh.mongo1.fax.plusdata | In scope | 2026-11-14 |
| mongo2.fax.plusdata | In scope | 2026-11-14 |
| mongo3.fax.plusdata | In scope | 2026-11-14 |
| msoffice.fax.plus | In scope | 2026-11-14 |
| beta.msoffice.fax.plusstaging | In scope | 2026-11-14 |
| at.orbit1.fax.plus | In scope | 2026-11-14 |
| cc.orbit1.fax.plus | In scope | 2026-11-14 |
| nn.orbit1.fax.plus | In scope | 2026-11-14 |
| releasenotes.fax.plus | In scope | 2026-11-14 |
| restapi.fax.plus | In scope | 2026-11-14 |
| staging.fax.plusstaging | In scope | 2026-11-14 |
| status.fax.plusmonitoring | In scope | 2026-11-14 |
| storage.fax.plus | In scope | 2026-11-14 |
| mta-sts.tls.fax.plus | In scope | 2026-11-14 |
| twiml.fax.plus | In scope | 2026-11-14 |
| vault.fax.plustools | In scope | 2026-11-14 |
| vault2.fax.plustools | In scope | 2026-11-14 |
| ws.fax.plus | In scope | 2026-11-14 |
| www.fax.plus | In scope | 2026-11-14 |
| wwwbeta.fax.plus | In scope | 2026-11-14 |
| wwwrtl.fax.plus | In scope | 2026-11-14 |
| zorro.fax.plus | In scope | 2026-11-14 |
| admin.sign.plusadmin | In scope | 2026-11-14 |
| affiliate.sign.plus | In scope | 2026-11-14 |
| api.sign.plusapi | In scope | 2026-11-14 |
| apidoc.sign.plus | In scope | 2026-11-14 |
| app.sign.plus | In scope | 2026-11-14 |
| e.sign.plus | In scope | 2026-11-14 |
| en.sign.plus | In scope | 2026-11-14 |
| mail.sign.plusmail | In scope | 2026-11-14 |
| in.mail.sign.plusmail | In scope | 2026-11-14 |
| fra.mongo1.sign.plusdata | In scope | 2026-11-14 |
| gva.mongo1.sign.plusdata | In scope | 2026-11-14 |
| zrh.mongo1.sign.plusdata | In scope | 2026-11-14 |
| next.sign.plus | In scope | 2026-11-14 |
| notifications.sign.plus | In scope | 2026-11-14 |
| sign-mongo-analytics.sign.plusdata | In scope | 2026-11-14 |
| staging.sign.plusstaging | In scope | 2026-11-14 |
| status.sign.plusmonitoring | In scope | 2026-11-14 |
| www.sign.plus | In scope | 2026-11-14 |
| wwwbeta.sign.plus | In scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.