*.githubapp.com provide a number of internal services to GitHub employees. These include our internal blog, helpdesk and bastion access to our internal network.
ssrf-target.iad.github.netto test out SSRF attacks.
Not all subdomains are in-scope for rewards at this time and are therefore ineligible for rewards. A list of out-of-scope subdomains is available in our scope section.