Skip to content
Connect AISign inSign up free

Bug bounty program

EB

ExpressVPN - Bug Bounty Program

Open on YesWeHackAtlas
Platform
YesWeHack
Bounties
Pays
Assets in scope
31
Disclosed reports
0
Subdomains
697

Most upvoted reports0

No report of this program is publicly disclosed

Subdomains697

Root
Scope
Name suggests
First seen
Text file697 names
Subdomains of ExpressVPN - Bug Bounty Program
NameScopeFirst seen
api.expressvpn.comapiIn scope2026-11-14
api-recovery.expressvpn.comapiIn scope2026-11-14
affiliates.api.expressvpn.comapiIn scope2026-11-14
billing.api.expressvpn.comapiIn scope2026-11-14
apidisco-aka.expressvpn.comIn scope2026-11-14
apis.expressvpn.comapiIn scope2026-11-14
apis-chi-11.expressvpn.comapiIn scope2026-11-14
apis-chi-12.expressvpn.comapiIn scope2026-11-14
apis-chi-6.expressvpn.comapiIn scope2026-11-14
apis-chi-7.expressvpn.comapiIn scope2026-11-14
apis-chi-8.expressvpn.comapiIn scope2026-11-14
apischi-6.expressvpn.comIn scope2026-11-14
apischi-7.expressvpn.comIn scope2026-11-14
apischi-8.expressvpn.comIn scope2026-11-14
auth.expressvpn.comauthIn scope2026-11-14
backend.expressvpn.comIn scope2026-11-14
backend-restricted.expressvpn.comIn scope2026-11-14
www.backend-restricted.expressvpn.comIn scope2026-11-14
www.backend.expressvpn.comIn scope2026-11-14
be-okta.expressvpn.comauthIn scope2026-11-14
billing-portal.expressvpn.comIn scope2026-11-14
blog.expressvpn.comIn scope2026-11-14
www.blog.expressvpn.comIn scope2026-11-14
checkout.expressvpn.comIn scope2026-11-14
hotfix.checkout.expressvpn.comIn scope2026-11-14
renue-integration.checkout.expressvpn.comIn scope2026-11-14
sandbox.checkout.expressvpn.comtestIn scope2026-11-14
staging.checkout.expressvpn.comstagingIn scope2026-11-14
staging-cdn-com.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-265.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-293.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-300.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-303.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-395.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-400.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-401.checkout.expressvpn.comstagingIn scope2026-11-14
staging-pr-442.checkout.expressvpn.comstagingIn scope2026-11-14
staging-renue-integration.checkout.expressvpn.comstagingIn scope2026-11-14
staging-test.checkout.expressvpn.comstaging, testIn scope2026-11-14
test.checkout.expressvpn.comtestIn scope2026-11-14
clicks.expressvpn.comIn scope2026-11-14
link.clicks.expressvpn.comIn scope2026-11-14
connectivitycheck.expressvpn.comIn scope2026-11-14
dc-1.expressvpn.comIn scope2026-11-14
5b16748e4881b6def3578624126ba525.dns-leak-test.expressvpn.comtestIn scope2026-11-14
71d91f93d78b6b282a653b0420e995c3.dns-leak-test.expressvpn.comtestIn scope2026-11-14
download.expressvpn.comIn scope2026-11-14
email.expressvpn.comIn scope2026-11-14
o1.email.expressvpn.comIn scope2026-11-14
o2.email.expressvpn.comIn scope2026-11-14
enterprise.expressvpn.comIn scope2026-11-14
fe-chi-1.expressvpn.comIn scope2026-11-14
fe-chi-2.expressvpn.comIn scope2026-11-14
fechi-1.expressvpn.comIn scope2026-11-14
fechi-2.expressvpn.comIn scope2026-11-14
frontend.expressvpn.comIn scope2026-11-14
go.expressvpn.comIn scope2026-11-14
o4698.e.info.expressvpn.comIn scope2026-11-14
integration.expressvpn.comIn scope2026-11-14
api-v2-jwks.integration.expressvpn.comapiIn scope2026-11-14
internal.expressvpn.cominternalIn scope2026-11-14
landing-pages.expressvpn.comIn scope2026-11-14
staging.landing-pages.expressvpn.comstagingIn scope2026-11-14
link.mail.expressvpn.commailIn scope2026-11-14
o4697.e.news.expressvpn.comIn scope2026-11-14
origin.expressvpn.comIn scope2026-11-14
origin-wp.expressvpn.comIn scope2026-11-14
www.origin.expressvpn.comIn scope2026-11-14
o1.outbound-email.expressvpn.comIn scope2026-11-14
o2.outbound-email.expressvpn.comIn scope2026-11-14
o1.outboundemail.expressvpn.comIn scope2026-11-14
o2.outboundemail.expressvpn.comIn scope2026-11-14
payments.expressvpn.comIn scope2026-11-14
api.payments.expressvpn.comapiIn scope2026-11-14
public.payments.expressvpn.comIn scope2026-11-14
portal.expressvpn.comIn scope2026-11-14
cdn.portal.expressvpn.comIn scope2026-11-14
main-worker.portal.expressvpn.comIn scope2026-11-14
prod-rewrite.portal.expressvpn.comIn scope2026-11-14
rc.portal.expressvpn.comIn scope2026-11-14
staging.portal.expressvpn.comstagingIn scope2026-11-14
staging-business.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1000.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1001.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1004.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1011.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1012.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1026.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1028.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1038.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1043.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1047.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1053.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1058.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1063.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1066.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1068.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1073.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1082.portal.expressvpn.comstagingIn scope2026-11-14
staging-pr-1083.portal.expressvpn.comstagingIn scope2026-11-14

697 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated