Skip to content
Connect AISign inSign up free

Bug bounty program

MG

MTN Group

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
498
Disclosed reports
128
Subdomains
214,285

Most upvoted reports128

All reports
Most upvoted reports of MTN Group
ReportWeaknessDisclosedBountyVotes
SQL Injection on cookie parameterAnalysed#761304SQL Injection2020-05-03–323
SQLi | in URL pathsAnalysed#2958619SQL Injection2025-03-06–149
IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609Insecure Direct Object Reference2024-10-05–135
Yet Another OTP code Leaked in the API ResponseAnalysed#2635315Authentication2025-01-08–135
FULL ACCOUNT TAKEOVERAnalysed#2542372No weakness recorded2024-08-17–123
SQL injection in URL path leads to Database AccessAnalysed#2633959SQL Injection2025-01-08–115
Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881Authentication2024-09-14–109
DOM Based Reflected Cross Site ScriptingAnalysed#2321874Cross-site Scripting2024-12-25–104
Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197Cross-site Scripting2024-08-30–100
Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462Authentication2025-03-04–98

Subdomains214,285

Root
Scope
Name suggests
First seen
Text file214,285 names
Subdomains of MTN Group
NameScopeFirst seen
imap.mtn.cimailNot in the scope2026-11-14
immobilier.mtn.ciNot in the scope2026-11-14
ios.mtn.ciNot in the scope2026-11-14
jenkins-prod.mtn.ciciNot in the scope2026-11-14
kiosk.mtn.ciNot in the scope2026-11-14
livestreaming.mtn.ciNot in the scope2026-11-14
lonidoor.mtn.ciNot in the scope2026-11-14
lonidoor1.mtn.ciNot in the scope2026-11-14
ltmevaluation.mtn.ciNot in the scope2026-11-14
lyncdiscover.mtn.ciNot in the scope2026-11-14
lyncdiscoverinternal.mtn.ciNot in the scope2026-11-14
lyncpool.mtn.ciNot in the scope2026-11-14
lyncwebext.mtn.ciNot in the scope2026-11-14
api.madapi.mtn.ciapiNot in the scope2026-11-14
mail.mtn.cimailNot in the scope2026-11-14
mail1.mtn.cimailNot in the scope2026-11-14
mail2.mtn.cimailNot in the scope2026-11-14
meet.mtn.ciNot in the scope2026-11-14
merchantreg.mtn.ciNot in the scope2026-11-14
minio.mtn.cidataNot in the scope2026-11-14
mm.mtn.ciNot in the scope2026-11-14
mmg.mtn.ciNot in the scope2026-11-14
mms.mtn.ciNot in the scope2026-11-14
regapp.mms.mtn.ciNot in the scope2026-11-14
mobileadvertising.mtn.ciNot in the scope2026-11-14
mobileapp.mtn.ciNot in the scope2026-11-14
mobilemoney.mtn.ciNot in the scope2026-11-14
admin.mobilemoney.mtn.ciadminNot in the scope2026-11-14
cc.mobilemoney.mtn.ciNot in the scope2026-11-14
customercare.mobilemoney.mtn.ciNot in the scope2026-11-14
ewp.mobilemoney.mtn.ciNot in the scope2026-11-14
ewp-test.mobilemoney.mtn.citestNot in the scope2026-11-14
www.ewp-test.mobilemoney.mtn.citestNot in the scope2026-11-14
www.ewp.mobilemoney.mtn.ciNot in the scope2026-11-14
momoqrcodetest.mobilemoney.mtn.ciNot in the scope2026-11-14
partenaires.mobilemoney.mtn.ciNot in the scope2026-11-14
partner.mobilemoney.mtn.ciNot in the scope2026-11-14
partner1.mobilemoney.mtn.ciNot in the scope2026-11-14
mobiliers.mtn.ciNot in the scope2026-11-14
momo.mtn.ciNot in the scope2026-11-14
momo4business.mtn.ciNot in the scope2026-11-14
momobusiness.mtn.ciNot in the scope2026-11-14
momopartenaire.mtn.ciNot in the scope2026-11-14
momopayment.mtn.ciNot in the scope2026-11-14
momoqrcode.mtn.ciNot in the scope2026-11-14
momoqrcodetestmobilemoney.mtn.ciNot in the scope2026-11-14
moncompte.mtn.ciNot in the scope2026-11-14
moninternet.mtn.ciNot in the scope2026-11-14
moninternet1.mtn.ciNot in the scope2026-11-14
monticket.mtn.ciNot in the scope2026-11-14
mscloud.mtn.ciNot in the scope2026-11-14
msg.mtn.ciNot in the scope2026-11-14
mtn1app.mtn.ciNot in the scope2026-11-14
mtncchicapp.mtn.ciNot in the scope2026-11-14
mtncchicapptest.mtn.ciNot in the scope2026-11-14
mtner.mtn.ciNot in the scope2026-11-14
mtnevents.mtn.ciNot in the scope2026-11-14
mtnmomopay.mtn.ciNot in the scope2026-11-14
mtnpasswordreset.mtn.ciNot in the scope2026-11-14
mtnplay.mtn.ciNot in the scope2026-11-14
www.mtnplay.mtn.ciNot in the scope2026-11-14
mtnplaydr.mtn.ciNot in the scope2026-11-14
mtnsignature.mtn.ciNot in the scope2026-11-14
mtntv.mtn.ciNot in the scope2026-11-14
www.mtntv.mtn.ciNot in the scope2026-11-14
mtntvstream.mtn.ciNot in the scope2026-11-14
musicplus.mtn.ciNot in the scope2026-11-14
mx1.mtn.ciNot in the scope2026-11-14
myinternet.mtn.ciNot in the scope2026-11-14
news.mtn.ciNot in the scope2026-11-14
ns1.mtn.ciNot in the scope2026-11-14
ns2.mtn.ciNot in the scope2026-11-14
ns4.mtn.ciNot in the scope2026-11-14
ogw.mtn.ciNot in the scope2026-11-14
openservices.mtn.ciNot in the scope2026-11-14
orion.mtn.ciNot in the scope2026-11-14
otpapi.mtn.ciNot in the scope2026-11-14
p10debrief.mtn.ciNot in the scope2026-11-14
partner.mtn.ciNot in the scope2026-11-14
partnermobilemoney.mtn.ciNot in the scope2026-11-14
passwordregistration.mtn.ciNot in the scope2026-11-14
passwordreset.mtn.ciNot in the scope2026-11-14
paymap.mtn.ciNot in the scope2026-11-14
pibceao.mtn.ciNot in the scope2026-11-14
policesecours.mtn.ciNot in the scope2026-11-14
ponthkb.mtn.ciNot in the scope2026-11-14
pool.mtn.ciNot in the scope2026-11-14
premium.mtn.ciNot in the scope2026-11-14
reclamation.mtn.ciNot in the scope2026-11-14
reclamationpc.mtn.ciNot in the scope2026-11-14
reclamationpilote.mtn.ciNot in the scope2026-11-14
regapp.mtn.ciNot in the scope2026-11-14
remedy.mtn.ciNot in the scope2026-11-14
reports-sponsoredata.mtn.ciNot in the scope2026-11-14
rgsfinder.mtn.ciNot in the scope2026-11-14
scoring.mtn.ciNot in the scope2026-11-14
securegate.mtn.ciNot in the scope2026-11-14
selfaccess.mtn.ciNot in the scope2026-11-14
selfreg.mtn.ciNot in the scope2026-11-14
selfregprod.mtn.ciNot in the scope2026-11-14

28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated