Optus Managed Bug Bounty
By Optus Bug bounty on Bugcrowd optus.com.au
- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 168
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $150.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 from $4,200 |
| High |
|
$2,500 from $2,000 |
| Medium |
|
$600 from $250 |
| Low |
|
$200 from $150 |
- Safe harbor
-
Full
we will not initiate or support legal action against you for accidental, good faith violations of this policy
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000
Scope
168 assets you may test, 65 excluded.
Networks 155
- 172.24.250.128
- 172.26.2.133
- 172.26.39.9
- 198.142.152.100
- 198.142.152.101
- 198.142.152.108
- 198.142.152.109
- 198.142.152.116
- 198.142.152.124
- 198.142.152.125
- 198.142.152.132
- 198.142.152.133
- 198.142.152.140
- 198.142.152.141
- 198.142.152.172
- 198.142.152.180
- 198.142.152.188
- 198.142.152.19
- 198.142.152.196
- 198.142.152.20
- 198.142.152.21
- 198.142.152.22
- 198.142.152.3
- 198.142.152.35
- 198.142.152.36
- 198.142.152.4
- 198.142.152.43
- 198.142.152.44
- 198.142.152.5
- 198.142.152.51
- 198.142.152.52
- 198.142.152.6
- 198.142.152.60
- 198.142.152.61
- 198.142.152.67
- 198.142.152.68
- 198.142.152.92
- 198.142.152.93
- 198.142.205.244
- 198.142.205.245
- 198.142.205.252
- 198.142.205.253
- 198.142.205.254
- 198.142.231.36
- 198.142.231.37
- 198.142.231.44
- 198.142.231.45
- 198.142.235.18
- 198.142.65.253
- 202.139.138.208/28
- 203.13.125.32/27
- 203.13.127.0/24
- 203.13.128.0/27
- 203.13.128.128/27
- 203.13.128.160/27
- 203.13.128.192/26
- 203.13.128.64/27
- 203.13.129.0/24
- 203.13.98.0/26
- 203.13.98.144/28
- 203.13.98.253/32
- 203.13.98.254/32
- 203.16.75.0/24
- 203.16.76.0/27
- 203.16.76.30
- 203.16.76.32/27
- 203.16.76.64/27
- 203.16.76.96/27
- 203.16.78.30
- 203.17.138.13
- 203.17.138.14
- 203.17.138.15
- 203.17.138.16
- 203.17.138.17
- 203.17.138.18
- 203.17.138.7
- 203.17.138.74
- 203.17.138.75
- 203.17.138.76
- 203.17.138.77
- 203.17.138.78
- 203.17.138.79
- 203.17.138.8
- 203.17.138.80
- 203.17.138.81
- 203.17.138.82
- 203.17.138.9
- 211.28.90.133
- 211.28.90.134
- 211.28.90.148
- 211.28.90.164
- 211.28.90.196
- 211.29.132.101
- 211.29.132.223
- 211.29.132.27
- 211.29.132.28
- 211.29.132.82
- 211.29.133.115
- 211.29.133.128
- 211.29.133.161
- 211.29.133.163
- 211.29.133.185
- 211.29.133.244
- 211.29.133.32
- 211.29.133.33
- 211.29.133.94
- 211.29.152.114
- 211.29.152.120
- 211.29.152.202
- 211.29.152.243
- 211.29.152.97
- 211.29.93.5
- 211.29.93.6
- 211.29.93.8
- 211.29.93.9
- 211.31.132.104
- 211.31.132.107
- 211.31.132.13
- 211.31.132.14
- 211.31.132.148
- 211.31.132.149
- 211.31.132.15
- 211.31.132.150
- 211.31.132.151
- 211.31.132.152
- 211.31.132.89
- 211.31.132.90
- 211.31.132.91
- 211.31.132.96
- 211.31.132.97
- 211.31.132.98
- 61.88.222.56
- 61.88.222.57
- 61.88.222.58
- 61.88.222.59
- dns0.optus.net.au
- dns1.optus.net.au
- https://ddosportal.optus.com.au
- ns1.optusnet.com.au
- ns2.optusnet.com.au
- ras1.optus.com.au
- speedtest-blacktown.optusnet.com.au
- speedtest-brisbane.optusnet.com.au
- speedtest-broome.optusnet.com.au
- speedtest-eastburwood.optusnet.com.au
- speedtest-geelong.optusnet.com.au
- speedtest-goldcoast.optusnet.com.au
- speedtest-hobart.optusnet.com.au
- speedtest-melbourne.optusnet.com.au
- speedtest-newcastle.optusnet.com.au
- speedtest-perth.optusnet.com.au
- speedtest-rockingham.optusnet.com.au
- speedtest-sydney.optusnet.com.au
- speedtest-townsville.optusnet.com.au
- vpn01.syd.optusnet.com.au
Web 8
- https://oes.optusnet.com.au
- https://ogws.optusnet.com.au
- https://optus.my.site.com/MyHub/s
- https://webmail.optusnet.com.au
- https://www.optus.com.au/osp-ecare
- https://www.optus.com.au/prepaid/activate
- https://www.outsourcing2.optus.net.au/eFRAMS3
- https://www.outsourcing.optus.net.au/eFRAMS3
APIs 2
- https://gateway.optus.com.au/api/ai-search/search/v1
- Naasapi.optus.com.au
Android apps 1
- https://play.google.com/store/apps/details?id=au.com.optus.selfservice&hl=en_AU&gl=US
iOS apps 1
- https://apps.apple.com/au/app/my-optus/id503716230
Wildcard domains 1
- *.optus.com.au
Out of scope (65)
- https://api-cdn.optussport.info/api/*
- https://api-cdn.optussport.tv/api/*
- https://static.sport.optus.com.au/api/*
- https://static.sport-pp.optus.com.au/api/*
- https://stats.akamai.optussport.tv
- https://stats.optussport.info
- https://stats-pp.akamai.optussport.tv
- https://stats.sport.optus.com.au
- 119.225.0.0/20
- 119.225.16.0/20
- 119.225.32.0/20
- 119.225.48.0/20
- 124.19.0.0/20
- 124.19.112.0/20
- 124.19.16.0/20
- 124.19.32.0/20
- 124.19.48.0/20
- 124.19.96.0/20
- 125.63.128.0/20
- 125.63.144.0/20
- 125.63.160.0/20
- 125.63.176.0/20
- 1.44.112.0/20
- 1.44.144.0/20
- 1.44.192.0/20
- 1.44.64.0/20
- 1.44.80.0/20
- 59.154.0.0/20
- 59.154.128.0/20
- 59.154.144.0/20
- 59.154.160.0/20
- 59.154.176.0/20
- 59.154.32.0/20
- 59.154.48.0/20
- 59.154.64.0/20
- 59.154.80.0/20
- 59.154.96.0/20
- 103.213.120.0/24
- 103.213.121.0/24
- Any other Optus Sport asset
- brand.optus.com.au
- https://chromecast-pp.optussport.tv
- https://cms.optussport.tv
- https://cms-qa.optussport.tv
- https://cms-uat.optussport.tv
- https://samsung.optussport.tv
- https://samsung-pp.optussport.tv
- https://sport.optus.com.au
- https://static.cms.optussport.tv
- https://static.cms-qa.optussport.tv
- https://static.cms-uat.optussport.tv
- https://www.optus.com.au/portal/*
- ibs2.optus.com.au
- ibs.optus.com.au
- personal.optus.com.au
- yes4good.optus.com.au
- *.act.optusnet.com.au
- *.nsw.optusnet.com.au
- *.nt.optusnet.com.au
- *.optus.com.au/web/ocaportal.portal
- *.qld.optusnet.com.au
- *.sa.optusnet.com.au
- *.tas.optusnet.com.au
- *.vic.optusnet.com.au
- *.wa.optusnet.com.au
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Optus Managed Bug Bounty (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Optus require all researchers to add BUGCROWD and your bugcrowd handle to your traffic headers when testing e.g BUGCROWD: username .
-
Please refrain from engaging with support agents through the live messaging service on the target website.
-
All program-related questions and communication should be directed to the Bugcrowd support team for assistance.
-
You may use self sign-up where applicable.
-
Do not use any credentials you may have otherwise found.
-
Application level DDOS can be submitted but please do not test your POC without first submitting your finding and requesting permission from our team
Not accepted
-
Other forms DDOS and DOS testing are out of scope.
-
Utilizing customer or leaked credentials.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
-
Scope +
Added to scope: brand.optus.com.au
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
124.19.0.0/20 (out of scope)
-
Scope added
125.63.176.0/20 (out of scope)
-
Scope added
125.63.160.0/20 (out of scope)
-
Scope added
125.63.144.0/20 (out of scope)
-
Scope added
125.63.128.0/20 (out of scope)
-
Scope added
124.19.112.0/20 (out of scope)
-
Scope added
124.19.96.0/20 (out of scope)
-
Scope added
124.19.48.0/20 (out of scope)
-
Scope added
124.19.32.0/20 (out of scope)
-
Scope added
124.19.16.0/20 (out of scope)
-
Scope added
119.225.48.0/20 (out of scope)
-
Scope added
119.225.32.0/20 (out of scope)
-
Scope added
119.225.16.0/20 (out of scope)
-
Scope added
119.225.0.0/20 (out of scope)
-
Scope added
59.154.176.0/20 (out of scope)
-
Scope added
59.154.160.0/20 (out of scope)
-
Scope added
59.154.144.0/20 (out of scope)
-
Scope added
59.154.128.0/20 (out of scope)
-
Scope added
59.154.96.0/20 (out of scope)
-
Scope added
59.154.80.0/20 (out of scope)
-
Scope added
59.154.64.0/20 (out of scope)
-
Scope added
59.154.48.0/20 (out of scope)
-
Scope added
59.154.32.0/20 (out of scope)
-
Scope added
59.154.0.0/20 (out of scope)
-
Scope added
1.44.192.0/20 (out of scope)
-
Scope added
1.44.144.0/20 (out of scope)
-
Scope added
1.44.112.0/20 (out of scope)
-
Scope added
1.44.80.0/20 (out of scope)
-
Scope added
1.44.64.0/20 (out of scope)
-
Scope added
*.optus.com.au/web/ocaportal.portal (out of scope)
-
Scope added
https://www.optus.com.au/portal/* (out of scope)
-
Scope added
https://optus.my.site.com/MyHub/s/
-
Scope added
https://www.outsourcing2.optus.net.au/eFRAMS3/
-
Scope added
https://www.outsourcing.optus.net.au/eFRAMS3/
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Optus takes the security of our systems and customer data seriously, taking continual steps to ensure the protection of the services we provide. As part of aspiring to be best for our customers, we have introduced a Managed Bug Bounty Program. We value and support the work undertaken by the security research community and appreciate it when researchers take the time to report potential security vulnerabilities to us. Please review the program contents before submitting your findings. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of Optus not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Optus, you can report it to their VDP. However, be aware that it is ineligible for rewards or points-based compensation. Target Information: Access: All targets should be publicly accessible. If you run into issues, please let us know. Optus require all researchers to add BUGCROWD and your bugcrowd handle to your traffic headers when testing e.g BUGCROWD: username . Please refrain from engaging with support agents through the live messaging service on the target website. All program-related questions and communication should be directed to the Bugcrowd support team for assistance. Credentials: You may use self sign-up where applicable. Please note that any charges you may incur will not be refunded. Do not use any credentials you may have otherwise found. Out of scope Application level DDOS can be submitted but please do not test your POC without first submitting your finding and requesting permission from our team Other forms DDOS and DOS testing are out of scope. Optus utilises and hosts a number of third party providers and services which may be listed as subdomains of those which are in scope. We cannot authorise testing against these systems and will update the out of scope list as best we can as they are discovered. Utilizing customer or leaked credentials. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.
Optus - AI Search (in scope)
Generative AI based search capability for the My Optus app that surfaces “summary*”, “article suggestion” and “quick links” for customer search queries. Imprortant note Please refrain from engaging with support agents through the live messaging service on the target website. All program-related questions and communication should be directed to the Bugcrowd support team for assistance. Focus Areas Prompt Injection Vulnerability occurs when an attacker manipulates a large language model (LLM) through crafted inputs, causing the LLM to unknowingly execute the attacker’s intentions. Insecure Output Handling refers specifically to insufficient validation, sanitisation, and handling of the outputs generated by large language models before they are passed downstream to other components and systems. Sensitive Information Disclosure LLM applications have the potential to reveal sensitive information, proprietary algorithms, or other confidential details through their output. Out of Scope Please be mindful with rate limits and scanning with automated tools. Denial of service
In scope - Infrastructure (in scope)
Please note that for the regionalized speed test targets that they share similar codebases and infrastructure. If you find a vulnerability, there is a high probability that it will be found on the other targets. If the vulnerability is found to be part of a template or shared resource, it will be considered a duplicate.