mpesa

HackerOneView on HackerOne

RawAI Enhanced

12

In Scope

6

Out of Scope

In-Scope Assets (12)

Asset	Category	Bounty	Quick Links
*.m-pesa.com	WILDCARD	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
1442121355	IOS	Yes	-
1502222766	IOS	Yes	-
com.vodafone.mpesa.drc	ANDROID	Yes	Play Store APKPure APKMirror
com.vodafone.mpesa.ls	ANDROID	Yes	Play Store APKPure APKMirror
com.vodafone.mpesa.mozambique	ANDROID	Yes	Play Store APKPure APKMirror
m-pesa.africa	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
mpa.ekyc.backoffice.m-pesa.com	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
mpa.ekyc.selfregister.m-pesa.com	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
mpa.qr.web.m-pesa.com	OTHER	Yes	-
openapi.m-pesa.com	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
openapiportal.m-pesa.com	URL	Yes	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa

Out-of-Scope Assets (6)

Asset	Category	Bounty
business.m-pesa.com	URL	No
com.vodacom.mpesa.ls.business	ANDROID	No
mz.m-pesa.com	URL	No
ra.ls.m-pesa.com	URL	No
sso.m-pesa.vm.co.mz	URL	No
sso.pr.m-pesa.vm.co.mz	URL	No

Scope Changes (48)

Feb 25, 2026

Change	Asset	Category	Scope	Time
Added	sso.m-pesa.vm.co.mz	URL	Out of Scope	19:16
Added	com.vodafone.mpesa.drc	ANDROID	In Scope	19:16
Added	openapi.m-pesa.com	URL	In Scope	19:16
Added	*.m-pesa.com	WILDCARD	In Scope	19:16
Added	mpa.qr.web.m-pesa.com	URL	In Scope	19:16
Added	ra.ls.m-pesa.com	URL	Out of Scope	19:16
Added	mz.m-pesa.com	URL	Out of Scope	19:16
Added	m-pesa.africa	URL	In Scope	19:16
Added	1502222766	IOS	In Scope	19:16
Added	mpa.ekyc.selfregister.m-pesa.com	URL	In Scope	19:16
Added	business.m-pesa.com	URL	Out of Scope	19:16
Added	sso.pr.m-pesa.vm.co.mz	URL	Out of Scope	19:16
Added	mpa.ekyc.backoffice.m-pesa.com	URL	In Scope	19:16
Added	openapiportal.m-pesa.com	URL	In Scope	19:16
Added	com.vodafone.mpesa.ls	ANDROID	In Scope	19:16
Added	com.vodafone.mpesa.mozambique	ANDROID	In Scope	19:16
Added	1442121355	IOS	In Scope	19:16
Added	com.vodacom.mpesa.ls.business	ANDROID	Out of Scope	19:16

Feb 22, 2026

Change	Asset	Category	Scope	Time
Added	openapi.m-pesa.com	URL	In Scope	00:45
Added	mpa.ekyc.selfregister.m-pesa.com	URL	In Scope	00:45
Added	com.vodafone.mpesa.mozambique	ANDROID	In Scope	00:45
Added	1502222766	IOS	In Scope	00:45
Added	*.m-pesa.com	WILDCARD	In Scope	00:45
Added	sso.pr.m-pesa.vm.co.mz	URL	Out of Scope	00:45
Added	business.m-pesa.com	URL	Out of Scope	00:45
Added	mz.m-pesa.com	URL	Out of Scope	00:45
Added	mpa.qr.web.m-pesa.com	URL	In Scope	00:45
Added	sso.m-pesa.vm.co.mz	URL	Out of Scope	00:45
Added	com.vodacom.mpesa.ls.business	ANDROID	Out of Scope	00:45
Added	mpa.ekyc.backoffice.m-pesa.com	URL	In Scope	00:45
Added	openapiportal.m-pesa.com	URL	In Scope	00:45
Added	com.vodafone.mpesa.ls	ANDROID	In Scope	00:45
Added	com.vodafone.mpesa.drc	ANDROID	In Scope	00:45
Added	1442121355	IOS	In Scope	00:45
Added	m-pesa.africa	URL	In Scope	00:45
Added	ra.ls.m-pesa.com	URL	Out of Scope	00:45

Feb 21, 2026

Change	Asset	Category	Scope	Time
Removed	mpa.qr.web.m-pesa.com	OTHER	In Scope	21:38
Removed	m-pesa.africa	URL	In Scope	21:38
Removed	*.m-pesa.com	WILDCARD	In Scope	21:38
Removed	1502222766	IOS	In Scope	21:38
Removed	1442121355	IOS	In Scope	21:38
Removed	com.vodafone.mpesa.drc	ANDROID	In Scope	21:38
Removed	com.vodafone.mpesa.mozambique	ANDROID	In Scope	21:38
Removed	com.vodafone.mpesa.ls	ANDROID	In Scope	21:38
Removed	openapi.m-pesa.com	URL	In Scope	21:38
Removed	openapiportal.m-pesa.com	URL	In Scope	21:38
Removed	mpa.ekyc.selfregister.m-pesa.com	URL	In Scope	21:38
Removed	mpa.ekyc.backoffice.m-pesa.com	URL	In Scope	21:38