Bug bounty program
Expedia Group VDP
- Platform
- HackerOne
- Bounties
- None
- Assets in scope
- 33
- Disclosed reports
- 0
- Subdomains
- 7,454
Most upvoted reports0
No report of this program is publicly disclosed
Subdomains7,454
| Name | Scope | First seen |
|---|---|---|
| ftp.abritel.frdata | In scope | 2026-11-14 |
| mysql3.abritel.frdata | In scope | 2026-11-14 |
| kafka.us-west-2.test.lab.dsp.expedia.comdata, test | In scope | 2026-11-14 |
| components-catalogue-bucket.prod.epsdecaf.expedia.comdata | In scope | 2026-11-14 |
| components-infrastructure-bucket.prod.epsdecaf.expedia.comdata | In scope | 2026-11-14 |
| components-infrastructure-canary-bucket.prod.epsdecaf.expedia.comdata, staging | In scope | 2026-11-14 |
| components-infrastructure-main-bucket.prod.epsdecaf.expedia.comdata | In scope | 2026-11-14 |
| federated-uitk-bucket.prod.epsdecaf.expedia.comdata | In scope | 2026-11-14 |
| federated-uitk-canary-bucket.prod.epsdecaf.expedia.comdata, staging | In scope | 2026-11-14 |
| federated-uitk-main-bucket.prod.epsdecaf.expedia.comdata | In scope | 2026-11-14 |
| components-catalogue-bucket.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| components-infrastructure-bucket.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| components-infrastructure-canary-bucket.test.epsdecaf.expedia.comdata, staging, test | In scope | 2026-11-14 |
| components-infrastructure-main-bucket.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| federated-uitk-bucket.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| federated-uitk-canary-bucket.test.epsdecaf.expedia.comdata, staging, test | In scope | 2026-11-14 |
| federated-uitk-main-bucket.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| partner-reports-upload-test.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| rapid-content-files.us-east-1.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| rapid-content-files.us-west-2.test.epsdecaf.expedia.comdata, test | In scope | 2026-11-14 |
| ftp.expedia.comdata | In scope | 2026-11-14 |
| ftp1.expedia.comdata | In scope | 2026-11-14 |
| mbelwal-test-s3-int.us-west-2.test.gcotechp.expedia.comdata, test | In scope | 2026-11-14 |
| mail-db.expedia.comdata, mail | In scope | 2026-11-14 |
| haystack-ha-kafka-kin-test.test.monitoring.expedia.comdata, monitoring, test | In scope | 2026-11-14 |
| haystack-ha-kafka-test.test.monitoring.expedia.comdata, monitoring, test | In scope | 2026-11-14 |
| haystack-test-ha-kafka.test.monitoring.expedia.comdata, monitoring, test | In scope | 2026-11-14 |
| sftp.expedia.comdata | In scope | 2026-11-14 |
| ftp.homeaway.comdata | In scope | 2026-11-14 |
| ftp-01.hotels.comdata | In scope | 2026-11-14 |
| ftp.orbitz.comdata | In scope | 2026-11-14 |
7,377 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.