Optus Managed Bug Bounty

At a glance#

• Maximum payout: $5,000
• Public disclosure: Not allowed
• Managed by the platform: Yes
• Safe harbour: Full

In scope#

• https://play.google.com/store/apps/details?id=au.com.optus.selfservice&hl=en_AU&gl=US
• https://webmail.optusnet.com.au/
• https://apps.apple.com/au/app/my-optus/id503716230
• *.optus.com.au
• https://www.outsourcing.optus.net.au/eFRAMS3/
• https://www.outsourcing2.optus.net.au/eFRAMS3/
• https://www.optus.com.au/osp-ecare
• https://optus.my.site.com/MyHub/s/
• https://www.optus.com.au/prepaid/activate
• https://gateway.optus.com.au/api/ai-search/search/v1
• vpn01.syd.optusnet.com.au
• 172.24.250.128
• 198.142.65.253
• Naasapi.optus.com.au
• ras1.optus.com.au
• ns1.optusnet.com.au
• ns2.optusnet.com.au
• dns0.optus.net.au
• dns1.optus.net.au
• https://ddosportal.optus.com.au
• 172.26.39.9
• 172.26.2.133
• 211.28.90.133
• 211.28.90.134
• 211.28.90.148
• 211.28.90.164
• 211.28.90.196
• https://ogws.optusnet.com.au/
• https://oes.optusnet.com.au/
• speedtest-sydney.optusnet.com.au
• speedtest-newcastle.optusnet.com.au
• speedtest-blacktown.optusnet.com.au
• speedtest-melbourne.optusnet.com.au
• speedtest-geelong.optusnet.com.au
• speedtest-hobart.optusnet.com.au
• speedtest-perth.optusnet.com.au
• speedtest-broome.optusnet.com.au
• speedtest-rockingham.optusnet.com.au
• speedtest-eastburwood.optusnet.com.au
• speedtest-brisbane.optusnet.com.au

128 more assets on the official page.

Out of scope#

• https://www.optus.com.au/portal/*
• personal.optus.com.au
• yes4good.optus.com.au
• *.optus.com.au/web/ocaportal.portal
• 103.213.120.0/24
• 103.213.121.0/24
• ibs.optus.com.au
• ibs2.optus.com.au
• *.nsw.optusnet.com.au
• *.vic.optusnet.com.au
• *.wa.optusnet.com.au
• *.sa.optusnet.com.au
• *.qld.optusnet.com.au
• *.nt.optusnet.com.au
• *.act.optusnet.com.au
• *.tas.optusnet.com.au
• https://samsung-pp.optussport.tv/
• https://chromecast-pp.optussport.tv
• https://api-cdn.optussport.info/api/*
• https://static.sport-pp.optus.com.au/api/*
• https://stats-pp.akamai.optussport.tv
• https://stats.optussport.info
• https://cms-uat.optussport.tv
• https://cms-qa.optussport.tv
• https://static.cms-uat.optussport.tv
• https://static.cms-qa.optussport.tv
• Any other Optus Sport asset
• 1.44.64.0/20
• 1.44.80.0/20
• 1.44.112.0/20
• 1.44.144.0/20
• 1.44.192.0/20
• 59.154.0.0/20
• 59.154.32.0/20
• 59.154.48.0/20
• 59.154.64.0/20
• 59.154.80.0/20
• 59.154.96.0/20
• 59.154.128.0/20
• 59.154.144.0/20

Imported from the public directory. Always confirm scope on the official program page before testing.