Mail.ru: Reflected XSS.

XSS in aa.mail.ru and xd.mail.ru. Both projects are not in bug bounty scope...