Skip to content
Connect AISign inSign up free

Bug bounty program

OP

OPPO

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
133
Disclosed reports
4
Subdomains
3,641
Vendor on CyberSIXT
OPPO (24 CVEs, 0 exploited)

Most upvoted reports4

Most upvoted reports of OPPO
ReportWeaknessDisclosedBountyVotes
Arbitrary thread deletion on c.realme.com#869705Insecure Direct Object Reference–$60073
Information Disclosure at https://portal.finzfin.com/1.txt#1011073Information Disclosure–$5020
No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684Input Validation and Logic–$10014
RXSS in https://store.oppomobile.com/#869870Cross-site Scripting–$10010

Subdomains3,641

Root:realmemobile.com
Scope
Name suggests
First seen
Text fileClear filters74 names
Subdomains of OPPO
NameScopeFirst seen
amazonaws.podzone.net.demo.box.1.realmemobile.comtestNot in the scope2026-11-14
www.google.com-93e3ff-betaopen-betaopen-honors-engine.1.realmemobile.comNot in the scope2026-11-14
www.google.com-jun0mwcombucknortheastdocumentation.google.1.realmemobile.comNot in the scope2026-11-14
adx-ads.realmemobile.comNot in the scope2026-11-14
adx-id-ads.realmemobile.comNot in the scope2026-11-14
adx-in-ads.realmemobile.comNot in the scope2026-11-14
www.google.com-94e3ff-prod-it-prod-it-honors-92e3ff.alt.realmemobile.comNot in the scope2026-11-14
b1-ads.realmemobile.comNot in the scope2026-11-14
bdapi-ads.realmemobile.comNot in the scope2026-11-14
bdapi-id-ads.realmemobile.comNot in the scope2026-11-14
bdapi-in-ads.realmemobile.comNot in the scope2026-11-14
bjdata-ads.realmemobile.comNot in the scope2026-11-14
ck-ads.realmemobile.comNot in the scope2026-11-14
data-ads.realmemobile.comNot in the scope2026-11-14
data-id-ads.realmemobile.comNot in the scope2026-11-14
data-in-ads.realmemobile.comNot in the scope2026-11-14
data-sg-ads.realmemobile.comNot in the scope2026-11-14
dhfs-id.realmemobile.comNot in the scope2026-11-14
dhfs-in.realmemobile.comNot in the scope2026-11-14
dhfs-th.realmemobile.comNot in the scope2026-11-14
dhfs-vn.realmemobile.comNot in the scope2026-11-14
epoch.realmemobile.comNot in the scope2026-11-14
game.realmemobile.comNot in the scope2026-11-14
gl-theme.realmemobile.comNot in the scope2026-11-14
hdfsf.realmemobile.comNot in the scope2026-11-14
i-in-browser.realmemobile.comNot in the scope2026-11-14
i-magzine.realmemobile.comNot in the scope2026-11-14
id-game.realmemobile.comNot in the scope2026-11-14
id-store.realmemobile.comNot in the scope2026-11-14
id-theme.realmemobile.comNot in the scope2026-11-14
if-magzine.realmemobile.comNot in the scope2026-11-14
if-sg-magzine.realmemobile.comNot in the scope2026-11-14
ifind.realmemobile.comNot in the scope2026-11-14
iflow-in-browser.realmemobile.comNot in the scope2026-11-14
iflow-sg-browser.realmemobile.comNot in the scope2026-11-14
ifota.realmemobile.comNot in the scope2026-11-14
ifota-eu.realmemobile.comNot in the scope2026-11-14
ifota-in.realmemobile.comNot in the scope2026-11-14
in-epoch.realmemobile.comNot in the scope2026-11-14
in-game.realmemobile.comNot in the scope2026-11-14
in-store.realmemobile.comNot in the scope2026-11-14
in-theme.realmemobile.comNot in the scope2026-11-14
istore.realmemobile.comNot in the scope2026-11-14
5-systemuctions.in-game-gy-kubernetes-facebook.2.bo.webproxy.idc.mail.k8s-prd-m.realmemobile.commail, toolsNot in the scope2026-11-14
lb-realmemo-13306.realmemobile.comNot in the scope2026-11-14
lk.realmemobile.comNot in the scope2026-11-14
lkf.realmemobile.comNot in the scope2026-11-14
beta5.authentication-gy-omsector.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, stagingNot in the scope2026-11-14
beta5core.authentication-gypay.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m-chd.realmemobile.comdata, stagingNot in the scope2026-11-14
mailtraffichelp.m.realmemobile.comNot in the scope2026-11-14
beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, stagingNot in the scope2026-11-14
fanclub.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdataNot in the scope2026-11-14
beta5.authentication-gy.bo-facebook.profiles.webproxy.idc.bucket.mailtraffichelp.m.realmemobile.comdata, stagingNot in the scope2026-11-14
beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.i.mailtraffichelp.m.realmemobile.comdata, stagingNot in the scope2026-11-14
beta5.authentication-gy.bo-facebook.webproxy.idc.bucket.mailtraffichelptraffic.m.realmemobile.comdata, stagingNot in the scope2026-11-14
muc.realmemobile.comNot in the scope2026-11-14
my-game.realmemobile.comNot in the scope2026-11-14
my-store.realmemobile.comNot in the scope2026-11-14
ocloud-cloud-cn.realmemobile.comNot in the scope2026-11-14
ocloud-find-cn.realmemobile.comNot in the scope2026-11-14
otaafsg-cost.realmemobile.comNot in the scope2026-11-14
otafsg.realmemobile.comNot in the scope2026-11-14
otafsg-cost.realmemobile.comNot in the scope2026-11-14
otafsg1.realmemobile.comNot in the scope2026-11-14
ph-epoch.realmemobile.comNot in the scope2026-11-14
ph-game.realmemobile.comNot in the scope2026-11-14
ph-store.realmemobile.comNot in the scope2026-11-14
smtp.realmemobile.commailNot in the scope2026-11-14
theme.realmemobile.comNot in the scope2026-11-14
u-in-browser.realmemobile.comNot in the scope2026-11-14
uapi-ads.realmemobile.comNot in the scope2026-11-14
uc-id-cn-201105.realmemobile.comNot in the scope2026-11-14
vn-game.realmemobile.comNot in the scope2026-11-14
www.realmemobile.comNot in the scope2026-11-14

16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated