Scope Data

In Scope Assets:

• URL: 3.basecamp.com
• URL: launchpad.37signals.com
• EXECUTABLE: basecamp3.exe
• EXECUTABLE: Basecamp.app
• IOS: com.basecamp.bc3-ios
• ANDROID: com.basecamp.bc3
• WILDCARD: *.hey.com
• IOS: com.hey.app.ios
• ANDROID: com.basecamp.hey
• EXECUTABLE: HEY.app
• WINDOWS APP: HEY.exe
• EXECUTABLE: hey-mail
• URL: world.hey.com
• URL: fizzy.do

Out of Scope Assets:

• WILDCARD: *.basecamphq.com (OOS)
• URL: basecamp.com (OOS)
• WILDCARD: *.highrisehq.com (OOS)

In Scope Assets:

• EXECUTABLE: Arc on Mac
• IOS: id6472513080
• ANDROID: company.thebrowser.arc
• URL: arc.net
• URL: thebrowser.company
• URL: bcny.com
• EXECUTABLE: Arc on Windows
• EXECUTABLE: Dia
• URL: diabrowser.com

In Scope Assets:

• WILDCARD: *.bitmex.com
• URL: testnet.bitmex.com
• URL: www.bitmex.com
• OTHER: All Other BitMEX Assets
• OTHER: https://play.google.com/store/apps/details?id=com.bitmex.app.android.testnet
• OTHER: https://testflight.apple.com/join/533gFghn
• IOS: 1589023233
• ANDROID: com.bitmex.app.android

Out of Scope Assets:

• URL: academy.bitmex.com (OOS)
• URL: blog.bitmex.com (OOS)
• URL: research.bitmex.com (OOS)
• URL: support.bitmex.com (OOS)
• URL: status.bitmex.com (OOS)
• URL: affiliates.bitmex.com (OOS)
• URL: public.bitmex.com (OOS)
• URL: public-testnet.bitmex.com (OOS)
• URL: bitmex.freshdesk.com (OOS)
• URL: bitmex-org.freshworks.com (OOS)

In Scope Assets:

• URL: knox.beta.blendlabs.com

In Scope Assets:

• URL: kyc-onboarding.booking.com
• URL: account.booking.com
• URL: taxi.booking.com
• URL: widget.rentalcars.com
• URL: cars.booking.com
• URL: supplier.auth.toag.booking.com
• URL: paymentcomponent.booking.com
• URL: metasearch-api.booking.com
• URL: experiences.booking.com
• URL: webhooks.booking.com
• URL: taxis.booking.com
• URL: paybridge.booking.com
• URL: phone-validation.taxi.booking.com
• URL: indicative-pricing.taxi.booking.com
• URL: admin.booking.com
• URL: chat.booking.com
• URL: autocomplete.booking.com
• URL: distribution-xml.booking.com
• URL: paynotifications.booking.com
• URL: supply-xml.booking.com
• URL: accommodations.booking.com
• URL: portal.taxi.booking.com
• URL: flights.booking.com
• URL: secure-supply-xml.booking.com
• URL: booking.com
• URL: secure.booking.com
• URL: careers.booking.com
• WILDCARD: *.fareharbor.com
• WILDCARD: *.booking.com
• WILDCARD: *.rentalcars.com
• URL: http://secure-iphone-xml.booking.com/json/
• URL: spark.fareharbor.com
• URL: www.fareharbor.com
• URL: teleport.fareharbor.engineering
• URL: demo.fareharbor.com
• URL: readonly.fareharbor.com
• URL: marketing.fareharbor.com
• URL: sites.fareharbor.com
• URL: compass.fareharbor.com
• URL: fhdn.fareharbor.com
• WILDCARD: *.fareharbor.engineering
• URL: tableau.fareharbor.engineering
• URL: fareharborsites.com
• IOS: https://apps.apple.com/us/app/booking-com-hotels-travel/id367003839
• ANDROID: https://play.google.com/store/apps/details?id=com.booking&hl=en
• ANDROID: https://play.google.com/store/apps/details?id=com.booking.hotelmanager&hl=en
• IOS: https://apps.apple.com/us/app/pulse-for-booking-com-partners/id992795726
• URL: https://iphone-xml.booking.com/json/
• URL: https://secure-iphone-xml.booking.com/json/

Out of Scope Assets:

• URL: spadmin.booking.com/ (OOS)
• WILDCARD: www.booking.com/bbmanage/* (OOS)
• WILDCARD: www.booking.com/bbmanage/data/* (OOS)
• WILDCARD: secure.booking.com/company/* (OOS)
• WILDCARD: secure.booking.com/orgnode/* (OOS)
• URL: business.booking.com/ (OOS)
• URL: https://www.booking.com/bbm.html (OOS)
• URL: https://secure.booking.com/companyjoin.html (OOS)
• URL: https://secure.booking.com/enterprise/signon.en-gb.html (OOS)
• URL: https://ugcupload.booking.com/upload_bbtool_company_logo (OOS)
• URL: https://fareharbor.com/demo/ (OOS)
• URL: partnerfeedback.booking.com (OOS)
• URL: recruitmentsurveys.booking.com (OOS)
• URL: desk-demo.fareharbor.engineering (OOS)
• URL: desk-demo-api.fareharbor.engineering (OOS)
• URL: jobs.booking.com (OOS)
• URL: welcomekit.booking.com/ (OOS)
• URL: cpass.booking.com (OOS)
• URL: awscpasslab.booking.com (OOS)
• URL: ams.merchandise.booking.com (OOS)
• URL: medialibrary.booking.com (OOS)
• URL: www.sustainability.booking.com (OOS)
• URL: procurement.booking.com (OOS)

In Scope Assets:

• WILDCARD: *.boozt.com
• WILDCARD: *.booztlet.com
• IOS: com.boozt.app
• IOS: com.boozt.booztlet
• ANDROID: com.boozt
• ANDROID: com.booztlet
• URL: kronor.io

Out of Scope Assets:

• URL: analytics.boozt.com (OOS)
• URL: bmp.boozt.com (OOS)
• URL: www.kronor.io (OOS)
• URL: firmagaver.boozt.com (OOS)

In Scope Assets:

• ANDROID: com.brave.browser_beta
• URL: search.brave.com
• URL: talk.brave.com
• SOURCE_CODE: https://github.com/brave/brave-core
• EXECUTABLE: https://laptop-updates.brave.com/latest/osx
• EXECUTABLE: https://laptop-updates.brave.com/latest/winx64
• EXECUTABLE: https://laptop-updates.brave.com/latest/winia32
• EXECUTABLE: https://laptop-updates.brave.com/latest/dev/debian64
• EXECUTABLE: https://laptop-updates.brave.com/latest/dev/ubuntu64
• EXECUTABLE: https://laptop-updates.brave.com/latest/mint64
• EXECUTABLE: https://laptop-updates.brave.com/latest/fedora64
• EXECUTABLE: https://laptop-updates.brave.com/latest/openSUSE64
• EXECUTABLE: https://laptop-updates.brave.com/latest/linux64
• IOS: com.brave.ios.browser
• ANDROID: com.brave.browser
• SOURCE_CODE: https://github.com/brave-intl/bat-ledger
• SOURCE_CODE: https://github.com/brave-intl/bat-client
• SOURCE_CODE: https://github.com/brave-intl/bat-balance
• OTHER: 0x0d8775f648430679a709e98d2b0cb6250d2887ef
• OTHER: 0x44fcfabfbe32024a01b778c025d70498382cced0
• OTHER: 0x7c31560552170ce96c4a7b018e93cddc19dc61b6
• OTHER: 0xfbfa258b9028c7d4fc52ce28031469214d10daeb
• OTHER: 0x67fa2c06c9c6d4332f330e14a66bdf1873ef3d2b
• URL: brave.com
• URL: basicattentiontoken.org
• URL: creators.basicattentiontoken.org
• SOURCE_CODE: https://github.com/brave-intl/bat-publisher
• SOURCE_CODE: https://github.com/brave-intl/publishers
• SOURCE_CODE: https://github.com/brave/vault-updater
• SOURCE_CODE: https://github.com/brave-intl/bat-go
• URL: account.brave.com
• SOURCE_CODE: https://github.com/brave/*, https://github.com/brave-intl/*
• URL: api-dashboard.search.brave.com

Out of Scope Assets:

• SOURCE_CODE: https://github.com/brave/brave-ios (OOS)
• SOURCE_CODE: https://github.com/brave/browser-laptop (OOS)
• SOURCE_CODE: https://github.com/brave/browser-ios (OOS)
• SOURCE_CODE: https://github.com/brave/muon (OOS)
• ANDROID: com.linkbubble.playstore (OOS)
• SOURCE_CODE: https://github.com/brave/link-bubble (OOS)

In Scope Assets:

• URL: https://bug-bounty-dashboard.k8s.tools-001.d-use-1.braze-dev.com/
• URL: https://bug-bounty-api.k8s.tools-001.d-use-1.braze-dev.com/
• URL: https://bug-bounty-rest.k8s.tools-001.d-use-1.braze-dev.com/

In Scope Assets:

• URL: http://bumba.global

In Scope Assets:

• ANDROID: com.hotornot.app
• ANDROID: com.bumblebff.app
• URL: www.bumble.com
• URL: bma.bumble.com
• IOS: 930441707
• ANDROID: com.bumble.app
• ANDROID: com.badoo.mobile
• ANDROID: com.badoo.twa
• IOS: 351331194
• IOS: 403684733
• URL: badoo.com
• URL: eu1.badoo.com
• URL: us1.badoo.com
• URL: corp.badoo.com
• URL: m.badoo.com
• URL: meu1.badoo.com
• URL: mus1.badoo.com
• URL: hotornot.com
• URL: bma.badoo.com
• URL: badoocdn.com
• URL: translate.badoo.com
• URL: ccardseu1.badoo.com
• URL: ccardsus1.badoo.com
• URL: chatdate.app
• URL: www.geneva-staging.chat
• URL: www.geneva-staging.com
• URL: web.geneva-staging.com
• URL: geneva-staging.chat
• URL: app.geneva-staging.chat
• URL: links.geneva-staging.chat
• URL: links.geneva-staging.com
• URL: go.geneva-staging.com
• URL: presence.geneva-staging.chat
• URL: presence.geneva-staging.com
• URL: sockets.geneva-staging.chat
• URL: sockets.geneva-staging.com
• URL: api.geneva-staging.com
• URL: deeplinks.geneva-staging.com
• URL: deeplinks.geneva-staging.chat
• URL: payments.geneva-staging.chat
• URL: payments.geneva-staging.com
• URL: gateway.geneva-staging.com
• URL: gateway.geneva-staging.chat
• URL: router.geneva-staging.com
• URL: social.geneva-staging.com
• URL: social.geneva-staging.chat
• TESTFLIGHT: https://testflight.apple.com/join/Y4cHu289
• ANDROID: com.genevachat.staging
• URL: app.geneva-staging.com
• IOS: 6444040977

Out of Scope Assets:

• URL: blog.bumble.com (OOS)
• URL: shop.bumble.com (OOS)
• URL: honey.bumble.com (OOS)
• URL: thebeehive.bumble.com (OOS)

In Scope Assets:

• IOS: https://apps.apple.com/us/app/bybit-app/id1488296980
• WILDCARD: *.bybit.com
• ANDROID: https://play.google.com/store/apps/details?id=com.bybit.app&hl=en
• WILDCARD: *.bybit.eu
• URL: http://testnet.bybit.eu
• WILDCARD: *.bybit.tr
• URL: http://www.bybit.com/trade/tradfi/
• URL: http://www.bybit.com/en/alpha/overview/
• URL: http://www.byreal.io

In Scope Assets:

• WILDCARD: *.bykea.net
• ANDROID: com.bykea.pk
• ANDROID: com.bykea.pk.partner
• IOS: 1351179184
• URL: bykea.com
• URL: https://maps.bykea.net
• URL: https://leaflet-map.bykea.net
• URL: https://nominatim.bykea.net
• WILDCARD: https://googleplace*.bykea.net
• URL: https://geocode-beta.bykea.net
• URL: https://api.bykea.net
• WILDCARD: https://kronos*.bykea.net
• WILDCARD: https://loadboard*.bykea.net/
• WILDCARD: https://raptor*.bykea.net
• WILDCARD: https://*test*.bykea.net
• URL: tomoe.bykea.net

Out of Scope Assets:

• URL: www.tilismtechservices.com (OOS)
• WILDCARD: *.tellocast.com (OOS)

In Scope Assets:

• OTHER: *.capitalone.com
• OTHER: *.capitaloneshopping.com
• ANDROID: com.konylabs.capitalone
• ANDROID: com.wikibuy.prod.main
• OTHER: Capital One Shopping Browser Extension
• OTHER: *.capitalonegslbex.com
• OTHER: *.capitalone.ca
• IOS: 407558537
• IOS: 1089294040
• OTHER: Eno® Browser Extension

In Scope Assets:

• SMART_CONTRACT: https://github.com/smartcontractkit/staking-v0.1/tree/master/contracts
• OTHER: Faucets
• SOURCE_CODE: https://github.com/smartcontractkit/external-adapters-js/
• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts
• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts
• SOURCE_CODE: https://github.com/smartcontractkit/chainlink

Out of Scope Assets:

• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink (OOS)
• URL: create.smartcontract.com (OOS)
• URL: docs.chain.link (OOS)
• SOURCE_CODE: https://github.com/smartcontractkit/chainlink/tree/master/core/sgx (OOS)
• OTHER: Intercom (OOS)
• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink/tree/master/contracts (OOS)
• SOURCE_CODE: https://github.com/smartcontractkit/chainlink/tree/master/tools (OOS)
• SOURCE_CODE: https://github.com/smartcontractkit/chainlink/tree/master/integration (OOS)
• SOURCE_CODE: github.com/smartcontractkit/chainlink/examples (OOS)
• SOURCE_CODE: github.com/smartcontractkit/chainlink/contracts/src/*/dev (OOS)
• URL: chainlinklabs.com (OOS)
• SOURCE_CODE: https://github.com/smartcontractkit/chainlink/tree/master/core/internal (OOS)
• URL: blog.chain.link (OOS)
• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts/.../dev (OOS)
• SMART_CONTRACT: https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts/.../dev (OOS)

In Scope Assets:

• URL: chaturbate.com
• WILDCARD: *.highwebmedia.com
• URL: m.chaturbate.com
• WILDCARD: *.securegatewayaccess.com
• URL: billingsupport.chaturbate.com
• URL: secure.chaturbate.com
• WILDCARD: *.cb.dev
• WILDCARD: *.mmwebc.dev
• WILDCARD: *.mmcdn.com

Out of Scope Assets:

• URL: support.chaturbate.com (OOS)
• URL: status.chaturbate.com (OOS)
• URL: cbswag.com (OOS)

In Scope Assets:

• SOURCE_CODE: https://github.com/Chia-Network/chia-blockchain
• SOURCE_CODE: https://github.com/Chia-Network/chia-blockchain-gui
• SOURCE_CODE: https://github.com/Chia-Network/clvm_rs
• SOURCE_CODE: https://github.com/Chia-Network/chia_rs
• SOURCE_CODE: https://github.com/Chia-Network/chiapos
• SOURCE_CODE: https://github.com/Chia-Network/chiavdf
• URL: https://vault.chiatest.net/
• IOS: https://apps.apple.com/app/chia-signer/id6504493785
• URL: api.vault.chiatest.net

In Scope Assets:

• URL: api.circle.com
• URL: app.circle.com
• SMART_CONTRACT: https://github.com/circlefin/evm-cctp-contracts
• SMART_CONTRACT: http://github.com/circlefin/noble-cctp
• SMART_CONTRACT: https://github.com/circlefin/solana-cctp-contracts
• URL: console.circle.com
• SOURCE_CODE: https://github.com/circlefin/stablecoin-sui
• SMART_CONTRACT: https://github.com/circlefin/buidl-wallet-contracts
• SMART_CONTRACT: https://github.com/circlefin/stablecoin-evm
• SMART_CONTRACT: https://github.com/circlefin/noble-fiattokenfactory
• SOURCE_CODE: https://github.com/circlefin/stablecoin-aptos
• SOURCE_CODE: https://github.com/circlefin/sui-cctp
• SMART_CONTRACT: https://github.com/circlefin/evm-gateway-contracts
• SOURCE_CODE: https://github.com/circlefin/stablecoin-starknet
• SMART_CONTRACT: https://github.com/circlefin/evm-xreserve-contracts
• SOURCE_CODE: https://github.com/circlefin/aptos-cctp
• SMART_CONTRACT: https://github.com/circlefin/starknet-cctp
• SMART_CONTRACT: https://github.com/circlefin/evm-cpn-contracts
• SMART_CONTRACT: https://github.com/circlefin/stablecoin-near
• SMART_CONTRACT: https://github.com/circlefin/solana-gateway-contracts

Out of Scope Assets:

• URL: youtube.com (OOS)
• URL: x.com (OOS)

In Scope Assets:

• OTHER: Cloudflare D1
• OTHER: Cloudflare R2
• URL: http://github.com/cloudflare
• SOURCE_CODE: https://github.com/cloudflare/workerd
• OTHER: WARP desktop client
• URL: one.dash.cloudflare.com
• OTHER: *.cloudflarepartners.com
• OTHER: Cloudflare DNS
• URL: waf.cumulusfire.net
• OTHER: Cloudflare CASB
• OTHER: Workers
• OTHER: Cloudflare Tunnel
• OTHER: AMP Real URL
• OTHER: Cloudflare Cache
• OTHER: Magic Firewall
• OTHER: Cloudflare Zaraz
• OTHER: China Network
• OTHER: API Shield
• OTHER: Gateway
• OTHER: Browser Isolation
• OTHER: Images
• AI_MODEL: Workers AI
• OTHER: AI Gateway
• OTHER: Vectorize
• OTHER: Hyperdrive
• OTHER: Workers KV
• OTHER: Cloudflare Analytics
• OTHER: Cloudflare Durable Objects
• OTHER: Turnstile
• OTHER: Waiting Room
• OTHER: Magic WAN
• OTHER: Data Loss Prevention (DLP)
• OTHER: SSL/TLS
• OTHER: Cloudflare Workers CI
• URL: dash.cloudflare.com
• URL: cloudflareworkers.com
• URL: *.teams.cloudflare.com
• OTHER: Cloudflare Pages
• OTHER: CDNJS
• OTHER: WARP Mobile Apps
• OTHER: Cloudflare Access
• OTHER: Stream
• OTHER: 1.1.1.1 Resolver
• OTHER: Magic Transit
• OTHER: Spectrum
• OTHER: Load Balancing
• OTHER: Bot Management
• URL: api.cloudflare.com
• OTHER: Cloudflare Zero Trust/Cloudflare One
• URL: *.cloudflare.com
• OTHER: Open source tools from Cloudflare
• OTHER: Area 1

Out of Scope Assets:

• URL: support.cloudflare.com (OOS)
• URL: community.cloudflare.com (OOS)
• URL: support.cloudflarewarp.com (OOS)
• URL: events.www.cloudflare.com (OOS)
• OTHER: 172.65.0.0/16 (OOS)

In Scope Assets:

• URL: *.coinbase.com
• URL: *.cbhq.net
• ANDROID: com.coinbase.android
• CIDR: 54.175.255.192/27
• URL: pro.coinbase.com
• URL: custody.coinbase.com
• URL: commerce.coinbase.com
• URL: prime.coinbase.com
• OTHER: Other
• ANDROID: org.toshi
• IOS: org.toshi.distribution
• URL: institutional.coinbase.com
• URL: api.coinbase.com
• OTHER: https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad
• OTHER: *.base.org
• URL: cloud.coinbase.com
• ANDROID: com.coinbase.wallite
• URL: api.custody.coinbase.com
• SMART_CONTRACT: https://base.org
• OTHER: Web3 Smart Contracts
• URL: coinbase.com
• URL: http://coinbase.com
• URL: international.coinbase.com
• URL: nft.coinbase.com
• OTHER: Coinbase WaaS (Wallet as a Service)
• SOURCE_CODE: https://github.com/coinbase/cb-mpc
• WILDCARD: *.coinbase-corp.com
• IOS: com.vilcsak.bitcoin2

Out of Scope Assets:

• URL: paradex.io (OOS)
• URL: support.coinbase.com (OOS)
• URL: blog.coinbase.com (OOS)
• URL: engineering.coinbase.com (OOS)
• URL: developers.coinbase.com (OOS)
• URL: status.coinbase.com (OOS)
• URL: support.pro.coinbase.com (OOS)
• URL: *.blockspring.com (OOS)
• OTHER: N/A - Not Coinbase owned or operated (OOS)
• IOS: com.coinbase.pro (OOS)
• ANDROID: com.coinbase.pro (OOS)
• URL: tagomi.com (OOS)

In Scope Assets:

• URL: www.coinhako.com
• ANDROID: com.coinhako
• IOS: com.coinhako.app

In Scope Assets:

• ANDROID: com.coinspot.app
• IOS: 1541949985
• URL: www.coinspot.com.au
• URL: https://www.coinspot.com.au/v2/api

In Scope Assets:

• ANDROID: com.compass.compass
• IOS: https://apps.apple.com/us/app/compass-real-estate-homes/id692766504
• URL: www.compass.com

Out of Scope Assets:

• URL: http://www.compass.com/contact/ (OOS)
• URL: http://www.compass.com/api/v3/lead_forms/agent_profile (OOS)
• OTHER: Christie’s International Real Estate (OOS)
• OTHER: @properties (OOS)
• URL: glide.com (OOS)
• WILDCARD: *.ctccal.com (OOS)
• OTHER: Consumer’s Title of California (OOS)
• WILDCARD: *.chartwellescrow.com (OOS)
• OTHER: Chartwell (OOS)
• WILDCARD: *.legacytexastitle.com (OOS)
• OTHER: LegacyTexas Title (OOS)
• WILDCARD: *.firstalliancetitle.com (OOS)
• WILDCARD: *.sqstitle.com (OOS)
• OTHER: SQS Square Settlements (OOS)
• WILDCARD: *.attorneyskeytitle.com (OOS)
• WILDCARD: *.kvstitle.com (OOS)
• OTHER: KVS Title (OOS)
• OTHER: Glide (OOS)

In Scope Assets:

• URL: staking.consensys.io
• URL: https://consensys.io/
• WILDCARD: *.web3factory.consensys.net
• SMART_CONTRACT: https://etherscan.io/address/0xaca92e438df0b2401ff60da7e4337b687a2435da

Out of Scope Assets:

• URL: consensys-solutions.net (OOS)
• URL: www.mesh.xyz (OOS)

In Scope Assets:

• SOURCE_CODE: https://github.com/iqlusioninc/yubihsm.rs
• SOURCE_CODE: https://github.com/iqlusioninc/tmkms
• SOURCE_CODE: https://github.com/iqlusioninc/crates/tree/main/signatory
• SOURCE_CODE: https://github.com/cosmos/ledger-cosmos
• SOURCE_CODE: https://github.com/cosmos/ics23
• OTHER: CosmWasm
• OTHER: Packet Forward Middleware
• SOURCE_CODE: https://github.com/cosmos/gaia
• OTHER: CometBFT
• OTHER: Cosmos SDK
• OTHER: ibc-go
• OTHER: Horcrux
• OTHER: Hermes Relayer
• OTHER: IBC Go Relayer
• OTHER: Solidity IBC Eureka
• SOURCE_CODE: https://github.com/skip-mev/go-fast-contracts
• SOURCE_CODE: www.github.com/cosmos/evm
• SOURCE_CODE: https://github.com/cosmos/iavl

In Scope Assets:

• WILDCARD: https://*.creditkarma.com
• URL: accounts.creditkarma.com
• URL: www.creditkarma.ca
• URL: api.creditkarma.com
• ANDROID: com.creditkarma.mobile
• IOS: com.creditkarma.mobile
• URL: https://www.creditkarma.com/reviews/
• URL: blog.creditkarma.com
• WILDCARD: https://*.creditkarma.co.uk
• ANDROID: com.creditkarma.mobile.international
• IOS: com.creditkarma.mobile.international
• WILDCARD: https://*.creditkarma.ca
• URL: https://www.creditkarma.com/savings
• URL: support.creditkarma.ca

Out of Scope Assets:

• URL: taxsupport.creditkarma.com (OOS)
• URL: tax.creditkarma.com (OOS)
• URL: help.creditkarma.com (OOS)
• URL: https://www.creditkarma.com/all/advice (OOS)
• URL: appsflyer.com (OOS)
• URL: crashlytics.com (OOS)
• URL: taplytics.com (OOS)
• WILDCARD: https://www.creditkarma.com/article/* (OOS)
• URL: socialverification.creditkarma.com (OOS)
• URL: socialverification.stage.creditkarma.com (OOS)

In Scope Assets:

• WILDCARD: *.preempt.com
• WILDCARD: *.preemptsecurity.com
• WILDCARD: *.reposify.com
• URL: falcon-sandbox.com
• URL: hybrid-analysis.com
• IOS: apps.apple.com/us/app/crowdstrike-falcon/id1458815656
• ANDROID: play.google.com/store/apps/details?id=com.crowdstrike.falconmobile
• WILDCARD: *.crowdstrike.com
• URL: www.crowdstrike.org
• OTHER: CrowdStrike public infrastructure
• WILDCARD: *.bionic.ai
• URL: www.crowdstrike.com
• WILDCARD: *.flowsecurity.app
• WILDCARD: *.adaptive-shield.com
• WILDCARD: *.humio.com
• URL: onum.com
• URL: onum-labs.com
• URL: pangea.cloud
• WILDCARD: *.securecircle.com

In Scope Assets:

• URL: https://crypto.com/exchange
• URL: https://crypto.com/price
• URL: app.mona.co
• ANDROID: com.defi.wallet
• IOS: com.defi.wallet
• URL: merchant.crypto.com
• URL: js.crypto.com
• WILDCARD: *.mona.co
• OTHER: Crypto.com Wallet Extension
• URL: Crypto.com mobile app APIs that require an account
• URL: Crypto.com Exchange APIs that require an account
• URL: tax.crypto.com
• URL: https://crypto.com/nft
• URL: web.crypto.com
• URL: developer-platform-api.crypto.com
• SMART_CONTRACT: https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e
• URL: nadex.com
• ANDROID: co.mona.android
• IOS: com.monaco.mobile
• WILDCARD: *.crypto.com
• URL: developer.crypto.com
• URL: developer-api.crypto.com
• URL: og.com

Out of Scope Assets:

• SOURCE_CODE: https://github.com/crypto-com/cro-staking (OOS)
• SOURCE_CODE: https://github.com/crypto-com/swap-contracts-periphery (OOS)
• SOURCE_CODE: https://github.com/crypto-com/swap-contracts-core (OOS)
• SOURCE_CODE: https://github.com/crypto-com/chain-desktop-wallet (OOS)

In Scope Assets:

• URL: cs.money
• URL: support.cs.money
• URL: wiki.cs.money
• URL: 3d.cs.money
• URL: blog.cs.money

Out of Scope Assets:

• URL: old.cs.money (OOS)
• OTHER: CS.Money Antiscam (OOS)
• URL: grafana.cs.money (OOS)

In Scope Assets:

• URL: ap-s.cloud.com
• URL: eu.cloud.com
• URL: us.cloud.com
• URL: *.citrixworkspacesapi.net
• URL: onboarding.cloud.com
• URL: onboarding-*.cloud.com
• URL: accounts.cloud.com
• URL: adm.cloud.com
• URL: api.adm.cloud.com
• OTHER: Citrix Secure Access client for Windows
• IOS: Citrix Secure Access client for macOS
• OTHER: Citrix Secure Access client for iOS
• ANDROID: Citrix Secure Access client for Android
• OTHER: Citrix Secure Access client for Linux
• OTHER: Citrix End Point Analysis (EPA) client for Linux
• OTHER: Citrix End Point Analysis (EPA) client for Windows

Out of Scope Assets:

• URL: *.xmtest.cloud.com (OOS)
• URL: *.xmqa.cloud.com (OOS)
• URL: *.xmdev.cloud.com (OOS)
• URL: citrix.cloud.com (OOS)
• URL: www.cloud.com (OOS)
• URL: accounts-internal.cloud.com (OOS)
• OTHER: *.browser.cloud.com (OOS)
• URL: launch.cloud.com (OOS)
• URL: *.citrix*.com (OOS)
• URL: *.cloudburrito.com (OOS)
• URL: *.securevdr.com (OOS)
• URL: *.podio.com (OOS)
• URL: (yoursubdomain).us.iws.cloud.com (OOS)
• URL: (yoursubdomain).ap.iws.cloud.com (OOS)
• URL: (yoursubdomain).eu.iws.cloud.com (OOS)
• URL: (youriwssubdomain).cloud.com (OOS)

In Scope Assets:

• URL: databricks.com
• URL: accounts.cloud.databricks.com
• URL: https://dbc-9a3f8ed1-7608.cloud.databricks.com
• OTHER: Databricks Free Edition
• OTHER: Open Scope

Out of Scope Assets:

• WILDCARD: *.cloud.databricks.com (OOS)
• WILDCARD: *.azuredatabricks.net (OOS)
• WILDCARD: *.gcp.databricks.com (OOS)

In Scope Assets:

• OTHER: Tier 1
• OTHER: Tier 2
• URL: test.deribit.com
• ANDROID: com.deribit
• IOS: 1293674041
• URL: insights.deribit.com
• URL: pb.deribit.com
• WILDCARD: *.deribit.com

Out of Scope Assets:

• URL: trust.deribit.com (OOS)
• URL: support.deribit.com (OOS)
• URL: deribit.zendesk.com (OOS)
• WILDCARD: *.chattest.deribit.com (OOS)
• URL: office.deribit.com (OOS)

In Scope Assets:

• WILDCARD: *.deriv.com
• URL: app.deriv.com
• URL: smarttrader.deriv.com
• URL: cashier.deriv.com
• WILDCARD: *.deriv.cloud
• URL: oauth.deriv.com
• URL: api.deriv.com
• OTHER: github.com/deriv-com
• SOURCE_CODE: github.com/binary-com
• URL: derivws.com
• WILDCARD: *.derivws.com
• URL: secure-dfadmin.deriv.com

Out of Scope Assets:

• URL: deriv.slack.com (OOS)
• URL: tradingview.deriv.com (OOS)
• URL: besquare.deriv.com (OOS)
• URL: trade.mql5.com (OOS)
• URL: community.deriv.com (OOS)
• URL: https://deriv.atlassian.net/servicedesk/customer/user/signup (OOS)
• OTHER: Any 3rd party managed domain (OOS)
• URL: deriv.ae (OOS)
• WILDCARD: *.home.deriv.com (OOS)
• URL: help.deriv.com (OOS)
• WILDCARD: *.api-core.deriv.com (OOS)

In Scope Assets:

• URL: try.discourse.org
• SOURCE_CODE: https://github.com/discourse/discourse

In Scope Assets:

• NO_IN_SCOPE_TABLE

In Scope Assets:

• URL: www.doordash.com
• ANDROID: com.dd.doordash
• IOS: doordash.DoorDashConsumer

Out of Scope Assets:

• WILDCARD: *.dashapi.com (OOS)
• WILDCARD: *.doorcrawl.com (OOS)
• URL: http://help.doordash.com (OOS)
• WILDCARD: *.order.online (OOS)
• OTHER: DoorDash Payments (OOS)
• URL: careersatdoordash.com (OOS)
• URL: ir.doordash.com (OOS)
• WILDCARD: doordash.com/unified-gateway/* (OOS)
• URL: unified-gateway.doordash.com (OOS)
• URL: consumer-mobile-bff.doordash.com (OOS)
• URL: merchant-mobile-bff.doordash.com (OOS)
• URL: merchant-portal.doordash.com (OOS)
• URL: https://doordash.com/merchant (OOS)
• URL: track.doordash.com (OOS)
• URL: internal.doordash.com (OOS)
• WILDCARD: doordash.com/orders/drive/* (OOS)

In Scope Assets:

• SOURCE_CODE: https://github.com/DopplerHQ/cli
• URL: doppler.team
• URL: api.doppler.com
• URL: dashboard.doppler.com
• EXECUTABLE: doppler
• URL: share.doppler.com

Out of Scope Assets:

• URL: docs.doppler.com (OOS)
• URL: doppler.com (OOS)
• URL: community.doppler.com (OOS)
• URL: support.doppler.com (OOS)
• OTHER: https://github.com/DopplerHQ/awesome-bots (OOS)
• URL: http://calendly.com/doppler/enterprise (OOS)

In Scope Assets:

• URL: app.dynamic-preprod.xyz
• URL: demo.dynamic.xyz
• URL: app.dynamic.xyz

Out of Scope Assets:

• URL: billing.dynamic.xyz (OOS)

In Scope Assets:

• URL: account-sprint.dynatracelabs.com
• WILDCARD: *.sprint.dynatracelabs.com
• EXECUTABLE: Dynatrace OneAgent
• URL: myaccount-hardening.dynatracelabs.com
• URL: sso-sprint.dynatracelabs.com
• SOURCE_CODE: https://github.com/Dynatrace
• WILDCARD: *.sprint.apps.dynatracelabs.com
• EXECUTABLE: Dynatrace ActiveGate
• OTHER: All other Assets
• EXECUTABLE: Dynatrace MobileAgent
• OTHER: Core Assets

Out of Scope Assets:

• WILDCARD: *.dynatrace.com (OOS)
• EXECUTABLE: easyTravel demo application (OOS)
• WILDCARD: *.dev.dynatracelabs.com (OOS)
• EXECUTABLE: EasyTrade demo application (OOS)
• URL: university-staging.dynatracelabs.com (OOS)

In Scope Assets:

• OTHER: Other Dyson Assets
• OTHER: Github findings
• URL: www.dyson.com.ua
• URL: shop.dyson.tw
• URL: www.dyson.tw
• URL: www.gr.dyson.com
• URL: www.dyson.com.ee
• IOS: 993135524
• ANDROID: com.dyson.mobile.android
• HARDWARE: Dyson Connected Products (IoT Hardware)
• URL: www.dyson.co.uk
• URL: www.dyson.com
• URL: www.dysoncanada.ca
• URL: www.dyson.it
• URL: www.dyson.ie
• URL: www.dyson.ch
• URL: www.dyson.se
• URL: www.dyson.nl
• URL: www.dyson.at
• URL: www.dyson.be
• URL: www.dyson.pt
• URL: www.dyson.de
• URL: www.dyson.fr
• URL: www.dyson.no
• URL: www.dyson.dk
• URL: www.dyson.es
• URL: www.fi.dyson.com
• URL: api.dyson.se
• URL: api.dysoncanada.ca
• URL: api.dyson.dk
• URL: api.dyson.it
• URL: api.dyson.es
• URL: api.dyson.co.uk
• URL: api.dyson.at
• URL: api.dyson.nl
• URL: api.dyson.be
• URL: api.dyson.pt
• URL: api.dyson.no
• URL: api.dyson.de
• URL: api.dyson.ch
• URL: api.dyson.fr
• URL: api.dyson.ie
• URL: api.dyson.com
• URL: api.fi.dyson.com
• URL: www.dyson.pl
• URL: www.dyson.in
• URL: www.dyson.com.mx
• URL: www.dyson.com.sg
• URL: www.dyson.co.kr
• URL: www.dyson.co.nz
• URL: www.dyson.com.tr
• URL: www.dyson.ae
• URL: www.dyson.co.il
• URL: www.dyson.com.au
• URL: www.dyson.hk
• URL: www.dyson.co.th
• URL: www.dyson.my
• URL: shop.dyson.co.za
• URL: www.sa.dyson.com
• URL: www.dyson.cz
• URL: www.dyson.hu
• URL: www.dyson.co.jp
• URL: www.dyson.com.ro
• URL: www.dyson.vn
• URL: *.cp.dyson.com
• URL: www.dyson.cn

Out of Scope Assets:

• URL: community.dyson.com (OOS)
• URL: careers.dyson.com (OOS)
• URL: comm.dyson* (OOS)
• URL: bounce.dyson* (OOS)
• WILDCARD: *dyson-demo.com (OOS)
• WILDCARD: *.dynsystem.kr (OOS)
• URL: sakti3.com (OOS)
• URL: on.dyson.co.uk (OOS)
• URL: sm2.dyson.com (OOS)
• URL: m.shop.dyson.cn (OOS)
• URL: register-dyson.co.kr (OOS)
• URL: jobs.dyson.com (OOS)
• URL: reviews.dyson* (OOS)
• URL: sm3.dyson.com (OOS)
• URL: view.dyson.com (OOS)
• URL: mail.register-dyson.co.kr (OOS)
• URL: test.oepay.dyson.cn (OOS)
• URL: shop.dyson.co.kr (OOS)
• URL: *central.dyson.com (OOS)
• URL: shop.dyson.ru (OOS)
• URL: jamesdysonfoundation.* (OOS)
• URL: aio.shop.china-dyson.com (OOS)
• URL: q.dyson.cn (OOS)
• URL: api.q.dyson.cn (OOS)
• URL: fsc.dyson.com (OOS)
• URL: auth.dysonrecall.com (OOS)
• URL: centraltest.dyson.com (OOS)
• URL: 30secondbleeps.com (OOS)
• URL: www.dyson.ovh (OOS)
• URL: dysontherapie.fr (OOS)
• URL: svn.dyson.com (OOS)
• URL: central-test.dyson.com (OOS)

In Scope Assets:

• WILDCARD: *.zellepay.com
• WILDCARD: *.earlywarning.com
• WILDCARD: *.zelle.com
• URL: zellepay.force.com
• URL: zelleservice.my.site.com
• URL: ews-fusion.my.site.com
• WILDCARD: developer*.earlywarning.com
• WILDCARD: support*.earlywarning.com

Out of Scope Assets:

• WILDCARD: api.zmsp.*.earlywarning.io (OOS)
• WILDCARD: *bc.earlywarning.com (OOS)
• URL: platformtest.cat.earlywarning.io (OOS)
• URL: platform.cat.earlywarning.io (OOS)
• URL: toolkit.zellepay.com (OOS)
• URL: docs.earlywarning.com (OOS)
• URL: demo.earlywarning.com (OOS)
• WILDCARD: *.clearxchange.com (OOS)
• URL: flip0717.earlywarning.com (OOS)
• URL: ccpa.zellepay.com (OOS)
• WILDCARD: ccpa*.zellepay.com (OOS)
• URL: zellepay.earlywarning.com (OOS)
• URL: http://api.zellepay.com (OOS)
• URL: http://api.zmsp.earlywarning.com (OOS)
• URL: http://earlywarningapi.force.com (OOS)

In Scope Assets:

• ANDROID: com.eero.android
• IOS: 1023499075
• HARDWARE: eero Devices
• WILDCARD: *.eero.com
• WILDCARD: *.e2ro.com

Out of Scope Assets:

• OTHER: Anything not in scope (OOS)
• OTHER: Services, Apps, Mobile (OOS)
• OTHER: Devices (OOS)

In Scope Assets:

• OTHER: Elastic Synthetics Monitoring
• WILDCARD: *.elstc.co
• URL: www.elastic.co
• WILDCARD: *.elasticnet.co
• WILDCARD: *.eops.nl
• OTHER: elastic.co credentials
• EXECUTABLE: Beats - Auditbeat
• EXECUTABLE: Beats - Filebeat
• EXECUTABLE: Beats - Heartbeat
• EXECUTABLE: Beats - Metricbeat
• EXECUTABLE: Beats - Packetbeat
• EXECUTABLE: Beats - Winlogbeat
• EXECUTABLE: Elastic Agent
• EXECUTABLE: Elastic Cloud Enterprise (ECE)
• EXECUTABLE: Elastic Cloud on Kubernetes (ECK)
• EXECUTABLE: Elastic Enterprise Search
• EXECUTABLE: Elastic Maps Server
• EXECUTABLE: Elasticsearch
• EXECUTABLE: Logstash
• EXECUTABLE: Observability - APM Agents
• EXECUTABLE: Observability - APM Server
• EXECUTABLE: Fleet Server
• EXECUTABLE: Kibana
• EXECUTABLE: Beats
• OTHER: Software Supply Chain
• OTHER: Elastic Clients
• URL: cloud.elastic.co
• WILDCARD: *.elastic.co
• WILDCARD: *.found.io
• WILDCARD: *.swiftype.com
• OTHER: Other
• OTHER: Elastic Package Registry
• EXECUTABLE: Elastic Defend
• EXECUTABLE: Beats - Osquerybeat
• EXECUTABLE: Elastic Distributions of OpenTelemetry (EDOT)
• WILDCARD: *.elastic.dev

Out of Scope Assets:

• URL: wiki.elastic.co (OOS)
• URL: jobs.elastic.co (OOS)
• URL: partners.elastic.co (OOS)
• WILDCARD: *.elasticsearch.cn (OOS)
• WILDCARD: https://github.com/elastic/*/wiki (OOS)
• URL: go.es.co (OOS)
• URL: info.elastic.co (OOS)
• URL: learn.elastic.co (OOS)
• URL: elasticon.elastic.co (OOS)
• URL: training.elastic.co (OOS)
• URL: link.email.elastic.co (OOS)
• URL: track.email.elastic.co (OOS)
• URL: sendgrid.elastic.co (OOS)
• URL: buy.elastic.co (OOS)
• WILDCARD: https://github.com/swiftype/*/wiki (OOS)
• URL: community.elastic.co (OOS)
• URL: discuss.elastic.co (OOS)
• URL: ip.es.io (OOS)
• URL: platform.keephq.dev (OOS)
• WILDCARD: *.keephq.dev (OOS)

In Scope Assets:

• ANDROID: com.enjin.mobile.wallet
• IOS: com.enjin.mobile.wallet
• OTHER: Enjin Coin - Ethereum ERC-20 Contract
• URL: nft.io
• URL: platform.enjin.io
• OTHER: Enjin Blockchain
• SOURCE_CODE: Enjin Indexer

Out of Scope Assets:

• URL: enjin.io (OOS)
• URL: enj.in (OOS)
• URL: docs.enjin.io (OOS)
• URL: cdn.nft.io (OOS)
• URL: faucet.canary.enjin.io (OOS)
• URL: support.enjin.io (OOS)
• URL: support.nft.io (OOS)
• URL: assets.enjin.io (OOS)
• URL: cdn.enjin.io (OOS)

In Scope Assets:

• URL: *.amplitude-game.com
• URL: *.audicagame.com
• URL: *.dancecentral.com
• URL: *.dropmix.com
• URL: *.singspacegame.com
• URL: *.harmonixmusic.com
• URL: *.hmxservices.com
• URL: *.hmxwebservices.com
• EXECUTABLE: FortniteClient-Win64-Shipping.exe
• EXECUTABLE: FortniteLauncher-Win64-Shipping.exe
• EXECUTABLE: FortniteLauncher-Win64-Shipping_BE.exe
• EXECUTABLE: FortniteLauncher-Win64-Shipping_EAC.exe
• EXECUTABLE: FortniteLauncher.exe
• ANDROID: FortniteClient-Android-Shipping-arm64-es2.apk
• URL: fortnite.com
• URL: hmxservices.com
• URL: harmonixmusic.com
• EXECUTABLE: UnrealEditorFortnite-Win64-Shipping.exe
• EXECUTABLE: EpicGamesLauncher.exe
• OTHER: EpicOnlineServices
• URL: aqtooling.com
• URL: aquiris.com.br
• URL: aquiris.studio
• URL: aquiristech.com
• URL: ballistic.com
• URL: ballistic.com.br
• URL: buckingfuggy.com
• URL: hc2services.com
• URL: hc2tooling.com
• URL: horizonchase.com.br
• URL: horizonchase.com
• URL: horizonchaseturbo.com
• URL: playwonderbox.com.br
• URL: playwonderbox.com
• URL: wonderboxapi.com
• URL: wonderboxdev.com
• IOS: id1520720139
• IOS: id1534920947
• URL: capturingreality.com
• EXECUTABLE: EOS C# SDK
• URL: *.rocketleague.com
• URL: *.psynet.gg
• URL: *.unrealtournament.com
• URL: *.epicgames.com
• URL: *.unrealengine.com
• URL: *.fortnite.com
• URL: *.epicgames.dev
• WILDCARD: *.epicgames.dev
• URL: metahuman.unrealengine.com
• URL: twinmotion.unrealengine.com
• URL: *.psyonix.com
• WILDCARD: *.twinmotion.com
• URL: fab.com
• OTHER: Any other Epic games owned asset not listed in the out of scope section
• URL: innersloth.kidswebservices.com
• URL: kidswebservices.com
• URL: niantic.kidswebservices.com
• URL: staging.kidswebservices.com
• OTHER: v1staging.kidswebservices.com
• OTHER: v1. kidswebservices.com
• URL: *.3lateral.com
• URL: *.cubicmotion.com
• URL: *.oncatapult.com
• URL: *.fallguys.com
• URL: *.mediatonic.co.uk
• URL: *.artstation.com
• URL: *.easy.ac
• URL: competitive.fortnite.com
• URL: create.fortnite.com
• URL: content-service.bfda.live.use1a.on.epicgames.com
• URL: content-service-live-testing.bfda.live.use1a.on.epicgames.com
• EXECUTABLE: UEFN
• URL: *.sketchfab.com
• URL: *.quixel.com
• URL: http://urc-uefn.live.ucs.on.epicgames.com
• URL: http://nexus.live.ucs.on.epicgames.com/
• URL: http://urc-auth-uefn.live.ucs.on.epicgames.com/
• WILDCARD: dev.epicgames.com/*
• URL: https://fngw-svc-gc-livefn.ol.epicgames.net/api/magpie
• URL: https://fngw-svc-ds-livefn.ol.epicgames.net/api/magpie
• URL: https://fn-commerce-live.eeef.live.use1a.on.epicgames.com/api/fn-commerce/
• URL: cosmo.fdeb.live.use1a.on.epicgames.com
• URL: https://communities.epicgames.com

Out of Scope Assets:

• URL: isitbandcampfriday.com (OOS)
• URL: *.bcbits.com (OOS)
• URL: *.superbeatsports.com (OOS)
• URL: admin.harmonixmusic.com (OOS)
• URL: support.harmonixmusic.com (OOS)
• URL: admin-dev.harmonixmusic.com (OOS)
• URL: web-admin.harmonixmusic.com (OOS)
• URL: teamcity-external.harmonixmusic.com (OOS)
• URL: tableau.harmonixmusic.com (OOS)
• URL: mail.harmonixmusic.com (OOS)
• URL: locustus.harmonixmusic.com (OOS)
• URL: jira.harmonixmusic.com (OOS)
• URL: confluence.harmonixmusic.com (OOS)
• URL: autodiscover.harmonixmusic.com (OOS)
• URL: swarm.harmonixmusic.com (OOS)
• URL: songsdb.harmonixmusic.com (OOS)
• URL: sompmgr-frontend.hmxservices.com (OOS)
• URL: sompmgr.hmxservices.com (OOS)
• URL: msoid.hmxservices.com (OOS)
• URL: fuser-admin-live-external.hmxservices.com (OOS)
• URL: fuser-admin-dev-external.hmxservices.com (OOS)
• URL: teamcity.hmxservices.com (OOS)
• URL: swarm-monitoring-node-01.hmxservices.com (OOS)
• URL: mon.hmxservices.com (OOS)
• URL: public-web-swarm-cluster.hmxservices.com (OOS)
• URL: www-api.hmxservices.com (OOS)
• URL: sompmgr-proxy-int.hmxservices.com (OOS)
• URL: sompmgr-dev-proxy-azure.hmxservices.com (OOS)
• URL: azure-int-proxy.hmxservices.com (OOS)
• URL: sompmgr-proxy-int-dev.hmxservices.com (OOS)
• URL: logstash-shipper-azure.hmxservices.com (OOS)
• URL: rb4-admin.hmxservices.com (OOS)
• URL: sompmgr-admin.hmxservices.com (OOS)
• URL: sompmgr-proxy-ext.hmxservices.com (OOS)
• URL: sompmgr-dev.hmxservices.com (OOS)
• URL: sompmgr-int-dev.hmxservices.com (OOS)
• URL: sompmgr-int.hmxservices.com (OOS)
• URL: sompmgr-dev-proxy-aws.hmxservices.com (OOS)
• URL: sompmgr-proxy-ext-dev.hmxservices.com (OOS)
• URL: audica-live-admin.hmxwebservices.com (OOS)
• URL: audica-prod-admin.hmxwebservices.com (OOS)
• URL: audica-prod-api.hmxwebservices.com (OOS)
• URL: dcvr-live-admin.hmxwebservices.com (OOS)
• URL: dcvr-prod-admin.hmxwebservices.com (OOS)
• URL: dropmix-dev-admin.hmxwebservices.com (OOS)
• URL: dropmix-prod-admin.hmxwebservices.com (OOS)
• URL: hype-dev-admin.hmxwebservices.com (OOS)
• URL: rb4ca-prod-admin.hmxwebservices.com (OOS)
• URL: rb4ca-staging-admin.hmxwebservices.com (OOS)
• EXECUTABLE: FortniteClient-Mac-Shipping.app (OOS)
• URL: msoid.harmonixmusic.com (OOS)
• URL: facebook.aquiris.com.br (OOS)
• URL: senior.aquiris.com.br (OOS)
• URL: vimeo.aquiris.com.br (OOS)
• URL: looneytuneswom.com (OOS)
• IOS: app.playwonderbox.com (OOS)
• URL: support.capturingreality.com (OOS)
• URL: news.capturingreality.com (OOS)
• URL: epicsupport.force.com (OOS)
• URL: docs.superawesome.tv (OOS)
• URL: learn.unrealengine.com (OOS)
• URL: docs.unrealengine.com (OOS)
• URL: udn.unrealengine.com (OOS)
• URL: watch.fortnite.com (OOS)
• URL: merch.fortnite.com (OOS)
• URL: eoshelp.epicgames.com (OOS)
• URL: answers.unrealengine.com (OOS)
• OTHER: Adobe Flash related submissions (OOS)
• WILDCARD: *.bandcamp.com (OOS)
• WILDCARD: *.bcbits.com (OOS)
• URL: communityportal.epicgames.com (OOS)
• URL: marketplacehelp.epicgames.com (OOS)
• URL: twinmotionhelp.epicgames.com (OOS)
• URL: issues.unrealengine.com (OOS)
• URL: damascushelp.epicgames.com (OOS)
• URL: mithrilhelp.epicgames.com (OOS)
• URL: stadiahelp.epicgames.com (OOS)
• URL: artportal.epicgames.com (OOS)
• URL: communities.unrealengine.com (OOS)
• URL: login.epicgames.com (OOS)
• URL: epicswag.com (OOS)
• URL: forums.unrealengine.com (OOS)
• URL: webinars.unrealengine.com (OOS)
• URL: http://brand.epicgames.com (OOS)
• OTHER: maestro.io (OOS)
• URL: start.gg (OOS)
• URL: skookum.chat (OOS)
• SOURCE_CODE: https://github.com/EpicGames/UnrealTournament (OOS)
• URL: mediaspace.unrealengine.com (OOS)
• URL: *.superawesome.tv (OOS)
• URL: *.superawesome.com (OOS)
• URL: *.popjam.com (OOS)
• URL: *.rukkaz.com (OOS)
• URL: *.jellychat.com (OOS)
• OTHER: Popjam Android application (OOS)
• OTHER: Rukkaz Android application (OOS)
• URL: http://superawesome.com/contact-us/ (OOS)
• URL: unrealfest.unrealengine.com (OOS)
• OTHER: *.bandcamp.com (OOS)
• URL: detroitlabs.epicgames.com (OOS)
• OTHER: Recent Acquisitions (OOS)

In Scope Assets:

• WILDCARD: *.zdev.net
• WILDCARD: *.zomato.com
• URL: winecellar.zomato.com
• ANDROID: com.application.zomato
• OTHER: All Assets (other than Blinkit)
• WILDCARD: http://*.grofer.io
• WILDCARD: http://*.grofers.com
• IOS: 960335206
• ANDROID: com.grofers.customerapp
• URL: api.grofers.com
• URL: api2.grofers.com
• URL: blinkit.com
• IOS: 434613896
• WILDCARD: *.zomans.com
• WILDCARD: *.hyperpure.com
• WILDCARD: *.runnr.in
• WILDCARD: *.district.in
• WILDCARD: *.edition.in
• WILDCARD: *.ticketnew.com
• WILDCARD: *.insider.in
• OTHER: Tier 2
• OTHER: Tier 1
• WILDCARD: *.tktnew.com
• OTHER: Tier 3
• ANDROID: com.blinkit.bistro
• IOS: 6670203019
• URL: bistro-api.blinkit.com
• ANDROID: com.application.zomato.district
• IOS: 6670536058
• WILDCARD: *.eternal.com
• URL: https://mcp-server.zomato.com/mcp
• OTHER: Data Protection Program

Out of Scope Assets:

• URL: www.zomatobook.com (OOS)
• URL: business-blog.zomato.com (OOS)
• WILDCARD: http://*.blinkit.support (OOS)
• ANDROID: com.application.zomato.ordering (OOS)
• URL: blog.zomato.com (OOS)
• URL: community.zomato.com (OOS)
• WILDCARD: *.zomatoportugal.com (OOS)
• URL: success.zomato.com (OOS)
• URL: dev.hyperpure.com (OOS)
• URL: devapi.hyperpure.com (OOS)
• URL: devpod.hyperpure.com (OOS)
• URL: send.zomato.com (OOS)
• WILDCARD: staging*.runnr.in (OOS)
• WILDCARD: *.bstro.io (OOS)
• WILDCARD: *.ali.zomans.com (OOS)

In Scope Assets:

• HARDWARE: https://us.eufy.com/products/t88711w1
• HARDWARE: https://us.eufy.com/products/t88511d1
• HARDWARE: https://us.eufy.com/products/t8410121
• IOS: com.security.BatteryCam
• HARDWARE: https://us.eufy.com/products/e8213181
• ANDROID: com.oceanwing.battery.cam
• IOS: com.security.care
• ANDROID: com.oceanwing.care.cam
• IOS: com.eufylife.EufyHome
• IOS: com.anker.AnkerMake
• ANDROID: com.oceanwing.FDMPrint
• HARDWARE: eufyMake E1
• HARDWARE: Solarbank 2 E1600 Pro
• ANDROID: com.anker.charging
• EXECUTABLE: eufyMake Studio software
• IOS: Anker

In Scope Assets:

• URL: www.evernote.com
• URL: accounts.evernote.com
• IOS: 281796108
• WINDOWS APP: 9wzdncrfj3mb
• EXECUTABLE: 406056744
• URL: api.evernote.com
• ANDROID: com.evernote

Out of Scope Assets:

• ANDROID: com.evernote.android (OOS)
• URL: help.evernote.com (OOS)

In Scope Assets:

• ANDROID: com.exness.investments
• URL: my.exness.com
• URL: pay.ibex.exchange
• URL: https://my.exness.com/webtrading/
• URL: exnessaffiliates.com
• URL: social-trading.exness.com
• URL: https://my.exness.com/pa/socialtrading
• URL: https://my.exness.com/pa/pim/manager
• URL: pwapi.ex2b.com
• URL: exness.com
• URL: api.excalls.mobi
• IOS: Exness Trade: Online Trading
• IOS: Exness Social Trading
• IOS: Exness Investor
• ANDROID: com.exness.android.pa

In Scope Assets:

• WILDCARD: *.exodus.io
• WILDCARD: *.a.exodus.io
• IOS: exodus-movement.exodus
• EXECUTABLE: Exodus Desktop Wallet
• WILDCARD: *.exodus.com
• OTHER: Passkey Wallet
• IOS: https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820
• ANDROID: https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN
• ANDROID: https://play.google.com/store/apps/details?id=com.exodus.grateful
• IOS: https://apps.apple.com/us/app/grateful-by-exodus/id6754093889
• WILDCARD: *.grateful.me

Out of Scope Assets:

• URL: exodusstore.blob.core.windows.net (OOS)
• URL: support.exodus.com (OOS)
• WILDCARD: get.exodus.* (OOS)
• URL: http://www.exodus.com/contact-support (OOS)
• URL: support-helpers.a.exodus.io (OOS)
• WILDCARD: www.exodus.com/job-application/* (OOS)
• URL: slack-invite.exodus.com (OOS)
• URL: https://exodus.atlassian.net (OOS)
• URL: http://exodus.com/keybase.txt (OOS)
• WILDCARD: *.atp-exodus.com (OOS)
• EXECUTABLE: Exodus Browser Extension (OOS)
• URL: exodus.atlassian.net (OOS)

In Scope Assets:

• URL: www.hotels.com
• URL: www.abritel.fr
• URL: www.bookabach.co.nz
• URL: www.fewo-direkt.de
• URL: www.stayz.com.au
• URL: www.expediagroup.com
• URL: www.flights.com
• ANDROID: com.hcom.android
• IOS: 284971959
• ANDROID: com.vrbo.android
• IOS: 1245772818
• URL: www.expedia.com
• URL: www.vrbo.com
• WILDCARD: *.vrbo.com
• WILDCARD: *.carrentals.com
• WILDCARD: *.wotif.com
• WILDCARD: *.cheaptickets.com
• WILDCARD: *.lastminute.co.nz
• WILDCARD: *.lastminute.com.au
• WILDCARD: *.travelocity.com
• WILDCARD: *.travelocity.ca
• WILDCARD: *.expediapartnercentral.com
• URL: www.hotwirepartnercentral.com
• IOS: 566635048
• ANDROID: com.hotwire.hotels
• URL: www.expediataap.com
• URL: www.orbitz.com
• URL: www.ebookers.com
• URL: www.ebookers.fi
• URL: www.mrjet.se
• ANDROID: com.ebookers
• ANDROID: com.orbitz
• IOS: 403546234
• IOS: 483394780
• URL: www.expedia-aarp.com
• IOS: 427916203
• ANDROID: com.expedia.bookings
• URL: www.carrentals.com
• URL: www.wotif.com
• URL: www.cheaptickets.com
• URL: www.lastminute.co.nz
• URL: www.lastminute.com.au
• URL: www.travelocity.com
• URL: www.travelocity.ca
• ANDROID: com.wotif.android
• ANDROID: com.cheaptickets
• ANDROID: com.travelocity.android
• IOS: 531549799
• IOS: 880759727
• IOS: 284803487

Out of Scope Assets:

• URL: www.expediaagents.com (OOS)
• WILDCARD: *.expediacruises.com (OOS)
• URL: china.airasiago.com (OOS)
• URL: thailand.airasiago.com (OOS)
• URL: bookus.expediacruises.com (OOS)
• WILDCARD: https://*.expedia.com/ (OOS)
• URL: www.expediapartnersolutions.com (OOS)