- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 67
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Partial
Please note that in this situation, no permission to test has been granted by Vodafone or any of its subsidiaries.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
67 assets you may test, 14 excluded.
Wildcard domains 66
- *.abcom.al Critical No bounty
- *.automotive.vodafone.com Critical No bounty
- *.automotive.vodafone.co.uk Critical No bounty
- *.automotive.vodafone.de Critical No bounty
- *.automotive.vodafone.es Critical No bounty
- *.automotive.vodafone.it Critical No bounty
- *.ayudavodafone.es Critical No bounty
- *.dsl.vodafone.de Critical No bounty
- *.iotportal.vodafone.com Critical No bounty
- *.iot.vm.co.mz Critical No bounty
- *.iot.vodafone.al Critical No bounty
- *.iot.vodafone.gr Critical No bounty
- *.iot.vodafoneinnovus.com Critical No bounty
- *.iot.vodafone.ro Critical No bounty
- *.iot.vodafone.swisscom.ch Critical No bounty
- *.iot.vodafone.tr Critical No bounty
- *.lowi.es Critical No bounty
- *.mobile.securenet.vodafone.com Critical No bounty
- *.mobile.securenet.vodafone.es Critical No bounty
- *.mobile.securenet.vodafone.gr Critical No bounty
- *.m-pesa.com Critical No bounty
- *.m-pesa.co.tz Critical No bounty
- *.my.upc.cz Critical No bounty
- *.my.vodafone.al Critical No bounty
- *.oitsimcontrol.safaricom.co.ke Critical No bounty
- *.onenumber.vodafone.com Critical No bounty
- *.securenet.vodafone.com Critical No bounty
- *.securenet.vodafone.de Critical No bounty
- *.securenet.vodafone.es Critical No bounty
- *.securenet.vodafone.ie Critical No bounty
- *.securenet.vodafone.it Critical No bounty
- *.unitymedia.de Critical No bounty
- *.upc.cz Critical No bounty
- *.upc.hu Critical No bounty
- *.vantagetowers.com Critical No bounty
- *.vcol.co.uk Critical No bounty
- *.vfpt.pt Critical No bounty
- *.vm.co.mz Critical No bounty
- *.vnd.it Critical No bounty
- *.vodacom.co.ls Critical No bounty
- *.vodacom.co.tz Critical No bounty
- *.vodacom.co.za Critical No bounty
- *.vodafoneadsl.it Critical No bounty
- *.vodafone.al Critical No bounty
- *.vodafoneaws.co.uk Critical No bounty
- *.vodafone.com Critical No bounty
- *.vodafone.com.tr Critical No bounty
- *.vodafone.co.uk Critical No bounty
- *.vodafonecu.gr Critical No bounty
- *.vodafone.cz Critical No bounty
- *.vodafone.de Critical No bounty
- *.vodafoneempresa.es Critical No bounty
- *.vodafone.es Critical No bounty
- *.vodafone.gr Critical No bounty
- *.vodafonehosting.gr Critical No bounty
- *.vodafone.ie Critical No bounty
- *.vodafoneinnovus.com Critical No bounty
- *.vodafone-ip.de Critical No bounty
- *.vodafone.it Critical No bounty
- *.vodafonemail.de Critical No bounty
- *.vodafonepark.com.tr Critical No bounty
- *.vodafonepay.com.tr Critical No bounty
- *.vodafone.pt Critical No bounty
- *.vodafone.ro Critical No bounty
- *.voda.it Critical No bounty
- *.voxi.co.uk Critical No bounty
Products and areas 1
- Vodafone Assets Critical No bounty
Out of scope (14)
- https://net-x-x-x-x.cust.dsl.vodafone.it
- https://smart.vodafone.com.eg
- https://voxxxxxxxx.mynet.vodafone.it
- https://vpn4.vodafone-us.com
- prg-x-xxx.static.adsl.vodafone.cz
- cst2-*-*.cust.vodafone.cz
- cst-prg-*-*.cust.vodafone.cz
- *.cust.dsl.vodafone.it
- *.cust.vodafonedsl.it
- *.ens.vodacom.co.za
- *.mynet.vodafone.it
- *.pool2.vodafone-ip.de
- *.pools.vodafone-ip.de
- *.rev.vodafone.pt
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Vodafone (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
please add the following custom HTTP header to all your requests: X-HackerOne-Research: [H1 Username]
-
Validate that the service you are reporting against is actually owned by Vodafone, and is not just running on an IP address within our customer-assigned IP address pools
-
Submit reports in English
-
Provide sufficient proof-of-concept to enable reproduction and verification of the vulnerability
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 17 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.cust.vodafonedsl.it (out of scope)
-
Scope added
*.mynet.vodafone.it (out of scope)
-
Scope added
*.pool2.vodafone-ip.de (out of scope)
-
Scope added
*.ens.vodacom.co.za (out of scope)
-
Scope added
*.pools.vodafone-ip.de (out of scope)
-
Scope added
*.rev.vodafone.pt (out of scope)
-
Scope added
cst-prg-*-*.cust.vodafone.cz (out of scope)
-
Scope added
cst2-*-*.cust.vodafone.cz (out of scope)
-
Scope added
https://net-x-x-x-x.cust.dsl.vodafone.it (out of scope)
-
Scope added
https://smart.vodafone.com.eg/ (out of scope)
-
Scope added
https://voxxxxxxxx.mynet.vodafone.it/ (out of scope)
-
Scope added
https://vpn4.vodafone-us.com (out of scope)
-
Scope added
prg-x-xxx.static.adsl.vodafone.cz (out of scope)
-
Scope added
*.abcom.al
-
Scope added
*.automotive.vodafone.co.uk
-
Scope added
*.automotive.vodafone.com
-
Scope added
*.automotive.vodafone.de
-
Scope added
*.automotive.vodafone.es
-
Scope added
*.automotive.vodafone.it
-
Scope added
*.ayudavodafone.es
-
Scope added
*.dsl.vodafone.de
-
Scope added
*.iot.vm.co.mz
-
Scope added
*.iot.vodafone.al
-
Scope added
*.iot.vodafone.gr
-
Scope added
*.iot.vodafone.ro
-
Scope added
*.iot.vodafone.swisscom.ch
-
Scope added
*.iot.vodafone.tr
-
Scope added
*.iot.vodafoneinnovus.com
-
Scope added
*.iotportal.vodafone.com
-
Scope added
*.lowi.es
-
Scope added
*.m-pesa.co.tz
-
Scope added
*.m-pesa.com
-
Scope added
*.mobile.securenet.vodafone.com
-
Scope added
*.mobile.securenet.vodafone.es
-
Scope added
*.mobile.securenet.vodafone.gr
-
Scope added
*.my.upc.cz
-
Scope added
*.my.vodafone.al
-
Scope added
*.oitsimcontrol.safaricom.co.ke
-
Scope added
*.onenumber.vodafone.com
-
Scope added
*.cust.dsl.vodafone.it (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
#Overview Vodafone is a telecommunications company who provide internet services for businesses and consumers in a number of regions. Due to the nature of our business, there are many Autonomous System (AS) Numbers and IP address ranges that are registered to us with the various Regional Internet Registries.
As an internet service provider, we assign these IP addresses to our customers, who use them for many different purposes and without any input or interaction from Vodafone. If you are scanning public IP address ranges and identify vulnerabilities on assets that, when searched on common IP look-up tools, state they are Vodafone, please take additional steps to validate that the services you have identified are actually owned and administered by Vodafone before reporting to us.
To summarise, not everything that has “vodafone” in its FQDN actually belongs to us or is within our scope. If you discover vulnerabilities in services hosted by Vodafone but owned by third parties, please report them to the application's owner. Please note that in this situation, no permission to test has been granted by Vodafone or any of its subsidiaries.
#Vodafone-Specific Requirements ###HTTP Headers:
- To help us distinguish legitimate security research from malicious traffic, please add the following custom HTTP header to all your requests: X-HackerOne-Research: [H1 Username]
###Asset Validation:
- Validate that the service you are reporting against is actually owned by Vodafone, and is not just running on an IP address within our customer-assigned IP address pools – for example, visit the service on an HTTP port and verify whether it is a Vodafone-owned website.
###Reporting Requirements:
- Submit reports in English
- Provide sufficient proof-of-concept to enable reproduction and verification of the vulnerability
###General Disclosure:
- This program follows HackerOne's standard disclosure guidelines. All vulnerabilities are strictly confidential, therefore public disclosure of your findings via a blog post, social media, or any other type of medium is not allowed.
###Vodafone Commitments:
- We treat all submitted reports confidentially and will not share the researcher personal details with third parties without authorisation, except when required by legal obligations.
- We will resolve all submitted reports as quickly as possible.
##Reporting other non-vulnerability issues If you want to report any other issue not related to security, please refer to the support or contact pages of the relevant Vodafone Local Market, Vodafone Partner Market, or Vodafone Business website.