🎣 The Curious Case of the Beg Bounty Bait — or: Licence to Phish
Not every day do I get an email from a very serious security researcher, clearly a man on a mission to save the internet — one vague, copy-pasted email at a time.
Here’s the message I received:
From: Peter Hooks <peterhooks007@gmail.com> Subject: Security Vulnerability Disclosure
Hi Team,
I’ve identified security vulnerabilities in your app that may put users at risk. I’d like to report these responsibly and help ensure they are resolved quickly.
Please advise on your disclosure protocol, or share details if you have a Bug Bounty program in place.
Looking forward to your reply.
Best regards, Peter Hooks
Right. Let’s unpack this.
🧯”Your App” — What App?
I’m not a company. I’m not a startup. I’m not even a garage-based stealth tech bro. I run a personal WordPress blog. That’s it.
There is no “app.” There are no “users at risk” (unless you count me, and I̷̜̓’̷̠̋m̴̪̓ ̴̹́a̸͙̽ḷ̵̿r̸͇̽ë̵͖a̶͖̋ḋ̵͓ŷ̴̼ ̴̖͂b̶̠̋é̶̻ÿ̴͇́ọ̸̒ń̸̦d̴̟̆ ̶͉͒s̶̀ͅa̶̡͗v̴͙͊i̵͖̊n̵͖̆g̸̡̔).
🕵️♂️ The Anatomy of a Beg Bounty Email
This little email ticks all the classic marks of what the security community affectionately calls a beg bounty — someone scanning random domains, finding trivial or non-issues, and fishing for a payout.
Thanks for your email and your keen interest in my “app” — spoiler alert: there isn’t one. Just a humble personal blog here.
Your message hits all the classic marks of a beg bounty reconnaissance email:
✅ Generic “Hi Team” greeting — because who needs names?
✅ Vague claims of “security vulnerabilities” with zero specifics
✅ Polite inquiry about a bug bounty program (spoiler: none here, James)
✅ No proof, no details, just good old-fashioned mystery
✅ Friendly tone crafted to reel in easy targets
✅ Email address proudly featuring “007” — very covert ops of you
Bravo. You almost had me convinced.
I’ll be featuring this charming little interaction in a blog post soon — starring you, of course. If you ever feel like upgrading from vague templates to actual evidence, I’m all ears. Until then, happy fishing!
Cheers, Amedee
😢 No Reply
Sadly, Peter didn’t write back.
No scathing rebuttal. No actual vulnerabilities. No awkward attempt at pivoting. Just… silence.
…it’s probably not the start of a beautiful friendship.
Got a similar email? Want help crafting a reply that’s equally professional and petty? Feel free to drop a comment or reach out — I’ll even throw in a checklist.
Until then: stay patched, stay skeptical, and stay snarky. 😎
What is a “beg bounty” email and how does it differ from legitimate vulnerability disclosure or bug bounty reports?
Amedee
A “beg bounty” is my deliberately informal term for an unsolicited email that invokes the possibility of a bug bounty without actually disclosing a vulnerability.
A legitimate vulnerability disclosure gives the recipient something actionable: what was found, where it was found, how to reproduce it, and ideally the security impact. A legitimate bug-bounty submission does the same, within the rules of an established bounty programme.
The email I received did none of that. It claimed to have found “vulnerabilities” in my “app”, but provided no vulnerability, affected component, reproduction steps, or evidence. Instead, it asked me to provide my disclosure protocol or tell them whether I had a bug bounty.
That’s why I called it “beg bounty bait”: the alleged vulnerability isn’t the information being disclosed; it’s the bait for getting me to engage in a conversation about vulnerability disclosure and potentially payment.
Of course, an unsolicited vulnerability report can be perfectly legitimate, and the absence of a bounty programme doesn’t make a report illegitimate. The distinction I’m making is between reporting a vulnerability and claiming to have a vulnerability in order to solicit a bounty-related response.
Amedee
There’s another reason I found the email suspicious: it was completely oblivious to its audience.
This is a personal blog, not a SaaS product, web application, or service with “users” whose data is apparently at risk. The email referred to “your app”, “your users”, and “vulnerabilities” without demonstrating any awareness of what it was actually contacting.
That makes it look much more like a mass mailing than the result of someone investigating my site. The wording is generic enough that it could have been sent to hundreds or thousands of unrelated websites with only the recipient name changed.
I obviously can’t prove whether it was AI-generated, but the combination of generic security jargon, lack of any site-specific technical detail, and the complete mismatch with the target is certainly consistent with an automated — possibly AI-assisted — campaign.
Ironically, if you’re going to send unsolicited vulnerability reports, showing that you’ve actually looked at the thing you’re reporting is probably a pretty good place to start. 🙂
@amedee these guys are so annoying indeed
What is a “beg bounty” email and how does it differ from legitimate vulnerability disclosure or bug bounty reports?
A “beg bounty” is my deliberately informal term for an unsolicited email that invokes the possibility of a bug bounty without actually disclosing a vulnerability.
A legitimate vulnerability disclosure gives the recipient something actionable: what was found, where it was found, how to reproduce it, and ideally the security impact. A legitimate bug-bounty submission does the same, within the rules of an established bounty programme.
The email I received did none of that. It claimed to have found “vulnerabilities” in my “app”, but provided no vulnerability, affected component, reproduction steps, or evidence. Instead, it asked me to provide my disclosure protocol or tell them whether I had a bug bounty.
That’s why I called it “beg bounty bait”: the alleged vulnerability isn’t the information being disclosed; it’s the bait for getting me to engage in a conversation about vulnerability disclosure and potentially payment.
Of course, an unsolicited vulnerability report can be perfectly legitimate, and the absence of a bounty programme doesn’t make a report illegitimate. The distinction I’m making is between reporting a vulnerability and claiming to have a vulnerability in order to solicit a bounty-related response.
There’s another reason I found the email suspicious: it was completely oblivious to its audience.
This is a personal blog, not a SaaS product, web application, or service with “users” whose data is apparently at risk. The email referred to “your app”, “your users”, and “vulnerabilities” without demonstrating any awareness of what it was actually contacting.
That makes it look much more like a mass mailing than the result of someone investigating my site. The wording is generic enough that it could have been sent to hundreds or thousands of unrelated websites with only the recipient name changed.
I obviously can’t prove whether it was AI-generated, but the combination of generic security jargon, lack of any site-specific technical detail, and the complete mismatch with the target is certainly consistent with an automated — possibly AI-assisted — campaign.
Ironically, if you’re going to send unsolicited vulnerability reports, showing that you’ve actually looked at the thing you’re reporting is probably a pretty good place to start. 🙂
Comments are closed.