Security research · reported to MTN Group via HackerOne
This page is served by an external security researcher on:
mtnfinancialservices.com mtninsure.com
.com registry to ns1.hostmax.me and
ns2.hostmax.me. The domain hostmax.me was unregistered and
available to anyone until 2026-09-29. Registering it grants full control of both DNS
zones — with no access to MTN infrastructure.
| Demonstrated | Arbitrary hostnames created in both zones, resolving worldwide |
Refused — null MX (MX 0 ., RFC 7505) | |
| Public certificates | Blocked — CAA 0 issue ";" |
| This certificate | Self-signed — no publicly-trusted CA, no CT log entry |
| Logging | Disabled — no visitor data recorded, DNS or HTTP |
| Mail read | None. No MTN system accessed. |
hostmax.me is held defensively so nobody else can take it. It is yours on request,
at no cost and with no conditions — reply on the HackerOne report and it will be
transferred, or removed, immediately.
Verify independently:
dig +norec +noall +authority NS mtnfinancialservices.com @a.gtld-servers.net
dig +short MX mtnfinancialservices.com → must return 0 .
whois hostmax.me → creation date 2026-09-29