E-mails about "Vulnerabilities in your site" from Elvin Isaac

19 May 2022

This page early draft and could have significant changes.

Recently I received an e-mail with the subject "Vulnerabilities in your site" from Elvin Isaac. Website owners periodically receive junk e-mails that end up in the trash instantly, but when it comes to website vulnerabilities, is not something that should be easily dismissed, so I did some digging to see if it's a real deal or a scam. I thought it would be wise to share my thoughts so others don't fall for it.

The first flag that this might be a scam was that the e-mail was automatically flagged as spam, meaning multiple people got something similar.

Furthermore, when investigating if this is a legitimate claim, if others received something like this, if Elvin Isaac is a real person, I decided to Google search, nothing came up. But then I noticed that Google showed as suggested related searches the following : "elvin isaac hacker", "elvin isaac bug bounty", "elvin isaac security", so it's pretty clear a bunch of people searched about Elvin Isaac recently.

Below is the e-mail I got:

------
From: Elvin Isaac <elvin.isaac009 @ ...>
Subject: Vulnerabilities in your site

Hi team,

Hope that you're doing all good and healthy.I would like to draw your
attention to some of the vulnerabilities in your site which i would like to
report.
Kindly provide me the email of relevant team or person and let me know if
there is any bug bounty program or reward regarding this disclosure of
vulnerabilities as this work requires both cost and time

Regards
*ELVIN*
------

One thing is for sure, Elvin Isaac is not a good Samaritan. He is also not a legitimate website visitor, stumbling on some critical website vulnerability and offering to help you out.

At the very best, Elvin Isaac is one of those people operating bots that scan websites for vulnerabilities, as such scans happen daily, that may or may not discovered anything. But based on information I gathered, some that I didn't make public, I believe this isn't even the case and that the person behind Elvin Isaac is just a scammer.

This kind of "offers" are not something new, you can read more here and here.