Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| bbs-test.coloros.comtest | Not in the scope | 2026-11-14 |
| otafs-test.coloros.comtest | Not in the scope | 2026-11-14 |
| uat-brand.heytap.comtest | Not in the scope | 2026-11-14 |
| 3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| 3-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-payments.tadpole-d.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| 3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.ns.otafsg1-az.e.heytap.comtest | Not in the scope | 2026-11-14 |
| 3-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| magnesium.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| 3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1-mail.tadpole-d.dockerjinx.ns.e.heytap.commail, test | Not in the scope | 2026-11-14 |
| 3-dropboxjinx.r0.rule-amarketingum-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.ecms1.heytap.comtest | Not in the scope | 2026-11-14 |
| epicac.3-dropbox.r0.rule-album-trafficn01a01a.ocloud-test-8-ww1.tool.tadpole-d.ns.e.e.heytap.comtest | Not in the scope | 2026-11-14 |
| mysql6.3-dropbox.r0.rule-album-trafficn01a01a.ocloud-test-8-ww1.tool.tadpole-d.ns.e.e.heytap.comdata, test | Not in the scope | 2026-11-14 |
| lax13-dropboxjinx.r0.rule-album-cn01a.ocloud-test-8-ww1evelynn.tadpole-d.ns.teaccountst-e.heytap.comtest | Not in the scope | 2026-11-14 |
| plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-plboards-euw-ww1.tadpole-d.dsfs.ns.apps-e.heytap.comtest | Not in the scope | 2026-11-14 |
| gusty.fwplboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1-cn01cloud.tadpole-d.dsfs.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| plboards.3-dropbox.r0.rule-album-cn01a.ocloud-test-8-ww1.tadpole-d.dsfs.authentication.ns.e.2016.heytap.comtest | Not in the scope | 2026-11-14 |
| plboards.3-dropbox.r0.rule-album-cn0tadpole-d-nova.ocloud-test-8-wwtadpole-d-nov.tadpole-d.dsfs-paywall.ns.e.heytap.comtest | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-qa.assets.restricted-prdcc-open-cdn.heytapdownload.comapi, test | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-honors-engine.accounting.assets-origin.sandbox-ghcpi.ctl.heytapdownload.comtest | Not in the scope | 2026-11-14 |
| 04ws3t1.prod.smtp.hawaii.test.online.pa.aservertw.8g.cc.heytapmobi.commail, test | Not in the scope | 2026-11-14 |
| 38wt5zv.test.mail.www.www.mail.smtp.correoweb.webserver.webmail.webserver.ts1.e0zyxw.8g.cc.heytapmobi.commail, test | Not in the scope | 2026-11-14 |
| www.google.com-business-og-docsapielopers-platform-worldwide-demo.180mmr-servicesbvrtsdbpg8nl1jc6cg9g.keke.cntest | Not in the scope | 2026-11-14 |
| test-4a.myoas.comtest | Not in the scope | 2026-11-14 |
| tms-uat.myoas.comtest | Not in the scope | 2026-11-14 |
| mtp-test.myoas.comtest | Not in the scope | 2026-11-14 |
| icsm-test.myoas.comtest | Not in the scope | 2026-11-14 |
| shimo-test.myoas.comtest | Not in the scope | 2026-11-14 |
| bvrsmmjkvfpbh9tr11d0.wire.communityphobos.test01apac.0.myoas.comtest | Not in the scope | 2026-11-14 |
| bvrueujpg8njhhl5nm20.test0ruleuslp.webproxy.idc.techhigh.applications.3.myoas.comtest | Not in the scope | 2026-11-14 |
| test.myoas.nettest | Not in the scope | 2026-11-14 |
| test1.myoas.nettest | Not in the scope | 2026-11-14 |
| test2.myoas.nettest | Not in the scope | 2026-11-14 |
| test.c.myoas.nettest | Not in the scope | 2026-11-14 |
| test-buy.myoas.nettest | Not in the scope | 2026-11-14 |
| test1-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| test1-oms.myoas.nettest | Not in the scope | 2026-11-14 |
| test2-oms.myoas.nettest | Not in the scope | 2026-11-14 |
| rcsm-test1.myoas.nettest | Not in the scope | 2026-11-14 |
| test1-static.myoas.nettest | Not in the scope | 2026-11-14 |
| test2-static.myoas.nettest | Not in the scope | 2026-11-14 |
| test1-oms-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| test2-oms-api.myoas.netapi, test | Not in the scope | 2026-11-14 |
| test-app-api.partner.myoas.netapi, test | Not in the scope | 2026-11-14 |
| www.google.com.comv2.test1-omsproxy-e6zyxw.0-sept.myoas.nettest | Not in the scope | 2026-11-14 |
| google.comdevelopmentmobileclient.skinscomv2-administrator.test1-omsproxy-e6zyxw.cloudstaff.tomcat0.myoas.netadmin, test | Not in the scope | 2026-11-14 |
| google.comdevelopmentmobileclient.vpnskinscomv2mobileclient.test1-omsproxy-e6zyxw.cloud.tomcat0-nov.myoas.nettest | Not in the scope | 2026-11-14 |
| www.google.com-test1-sso-account-start-make-money-online.iad-comazureproxyassets.test2-cc-testkuberproxyes.myoas.netauth, test | Not in the scope | 2026-11-14 |
| service-test.myoppo.comtest | Not in the scope | 2026-11-14 |
| bvrusnvagi69t4t2eb3g.service-test-account.2dbc3f05.apk.scm.myoppo.comgit, test | Not in the scope | 2026-11-14 |
| audio-test-bot.nearme.com.cntest | Not in the scope | 2026-11-14 |
| test.oppo.comtest | Not in the scope | 2026-11-14 |
| uat-www.oppo.comtest | Not in the scope | 2026-11-14 |
| uat-code.oppo.comtest | Not in the scope | 2026-11-14 |
| uat-image.oppo.comtest | Not in the scope | 2026-11-14 |
| cloud-test.oppo.comtest | Not in the scope | 2026-11-14 |
| webproxy.idcjoy.ids-uat.team.1.0.oppofind.comtest | Not in the scope | 2026-11-14 |
| webproxy.idcjoy.oarwww-uat.team.1.0.oppofind.comtest | Not in the scope | 2026-11-14 |
| nethl-oldsite-oarwww-emea.testing-0oa.oppofind.comtest | Not in the scope | 2026-11-14 |
| webproxy.idcjoy-global.ids-uat.team.1.0.oppofind.comtest | Not in the scope | 2026-11-14 |
| webproxy.idcjoyapidocs.ids-uat.team.1.0.oppofind.comtest | Not in the scope | 2026-11-14 |
| dmwso.redirectme.netoppofind.oarwww-emea.testing-0.oppofind.comtest | Not in the scope | 2026-11-14 |
| battle-websocket-instant-test.oppomobile.comtest | Not in the scope | 2026-11-14 |
| www.google.com.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-internals-373da1.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.12-testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.foreign-w3.internalsapplication.20-testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest.emea-fw.old.oppopay.comlegacy, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest-z.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com.network.demo-ifrus-eu-datafrontpage.foreign.testing.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1-jinx.testing-oedgetest.swag-tester.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-testingreset-staging.foreign-w3.internalsapplication.testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oedgetest-z.bitbucket.swag-testing.oppopay.comgit, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-partypledge-373da1staging.testing-oedgetest-z.124-testing.oppopay.comstaging, test | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.testing-oshoptest-z.swag-testerdriving-mobile.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1.v1-com-conn2-origin-373da1-samurai-qa.05swag-tester-shared.oppopay.comtest | Not in the scope | 2026-11-14 |
| www.google.com-conn2-origin-373da1-events-betaservice.testing-oedgetest-z.real-swag-tester.114.oppopay.comtest | Not in the scope | 2026-11-14 |
| test1-event.realme.nettest | Not in the scope | 2026-11-14 |
| www.google.com-smart-test-panel-digital-k8s-dev-host-statslications.diadmal.realmebbs.comadmin, dev, test, tools | Not in the scope | 2026-11-14 |
| amazonaws.podzone.net.demo.box.1.realmemobile.comtest | Not in the scope | 2026-11-14 |
| qa.1.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 00test.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 03demo.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| uat.00.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 00sandbox.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 03sandbox.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| testing.1.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| uat.0-139.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 00-testing.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 10demo1919.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 00-testing1.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 11-demo1919.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| qa.12secure.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| sandbox.12c.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| 11test2-oms-api.info.realmepaysa.comapi, test | Not in the scope | 2026-11-14 |
| 11test-grossesse.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| occ-0-1751-1009.test.1.info.realmepaysa.comtest | Not in the scope | 2026-11-14 |
| autoconfig.test1.1-mail.info.realmepaysa.commail, test | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.