Mail.ru: [account.my.com] Reflected XSS

Reflected XSS via POST parameters in account.my.com. account.my.com is not covered by bug bounty scope...