Skip to content
Connect AISign inSign up free

Bug bounty program

AV

Amazon Vulnerability Research Program

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
120
Disclosed reports
0
Subdomains
90,563
Vendor on CyberSIXT
Amazon (140 CVEs, 0 exploited)

Most upvoted reports0

No report of this program is publicly disclosed

Subdomains90,563

Root:amazon.de
Scope
Name suggests
First seen
Text fileClear filters468 names
Subdomains of Amazon Vulnerability Research Program
NameScopeFirst seen
app.social.amazon.deIn scope2026-11-14
sp.amazon.deIn scope2026-11-14
www.sp.amazon.deIn scope2026-11-14
spicy.amazon.deIn scope2026-11-14
sponsored-ads.amazon.deIn scope2026-11-14
sponsored-ads-eu.amazon.deIn scope2026-11-14
stage-business.amazon.destagingIn scope2026-11-14
static.amazon.deIn scope2026-11-14
storyplayer-photos.amazon.deIn scope2026-11-14
storyplayerbeta-photos.amazon.deIn scope2026-11-14
supplierconnect.amazon.deIn scope2026-11-14
supply.amazon.deIn scope2026-11-14
supplychain.amazon.deIn scope2026-11-14
supplychainconnect.amazon.deIn scope2026-11-14
support.amazon.deIn scope2026-11-14
supsupplychainconnect.amazon.deIn scope2026-11-14
sustainabilityexchange.amazon.deIn scope2026-11-14
terrier.amazon.deIn scope2026-11-14
test.amazon.detestIn scope2026-11-14
thumbnails-photos.amazon.deIn scope2026-11-14
transient.amazon.deIn scope2026-11-14
appx.transient.amazon.deIn scope2026-11-14
transponder.amazon.deIn scope2026-11-14
transportation.amazon.deIn scope2026-11-14
twitch.amazon.deIn scope2026-11-14
typepadwidgets.amazon.deIn scope2026-11-14
unagi.amazon.deIn scope2026-11-14
unagi-eu.amazon.deIn scope2026-11-14
upload-photos.amazon.dedataIn scope2026-11-14
cnt-03.upload-photos.amazon.dedataIn scope2026-11-14
vdp.amazon.deIn scope2026-11-14
vendorcentral.amazon.deIn scope2026-11-14
www.vendorcentral.amazon.deIn scope2026-11-14
vendornet.amazon.deIn scope2026-11-14
verkaufen.amazon.deIn scope2026-11-14
verkaufer.amazon.deIn scope2026-11-14
versand.amazon.deIn scope2026-11-14
www.versand.amazon.deIn scope2026-11-14
video.amazon.deIn scope2026-11-14
videodirectpublishing.amazon.deIn scope2026-11-14
videodistribution.amazon.deIn scope2026-11-14
videopublishing.amazon.deIn scope2026-11-14
videos.amazon.deIn scope2026-11-14
vine.amazon.deIn scope2026-11-14
vip.amazon.deIn scope2026-11-14
vpbs.amazon.deIn scope2026-11-14
watch.amazon.deIn scope2026-11-14
webservices.amazon.deapiIn scope2026-11-14
sha256.webservices.amazon.deapiIn scope2026-11-14
website-g7g.amazon.deIn scope2026-11-14
webstore.amazon.deIn scope2026-11-14
werben.amazon.deIn scope2026-11-14
werbung.amazon.deIn scope2026-11-14
widgets.amazon.deIn scope2026-11-14
ws.amazon.deIn scope2026-11-14
www.amazon.deIn scope2026-11-14
www1.amazon.deIn scope2026-11-14
www14.amazon.deIn scope2026-11-14
www15.amazon.deIn scope2026-11-14
www20.amazon.deIn scope2026-11-14
www22.amazon.deIn scope2026-11-14
www6.amazon.deIn scope2026-11-14
xml.amazon.deIn scope2026-11-14
your-account.amazon.deIn scope2026-11-14
your-orders.amazon.deIn scope2026-11-14
youraccount.amazon.deIn scope2026-11-14
yourorders.amazon.deIn scope2026-11-14
zshops.amazon.deIn scope2026-11-14

90,562 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated