I received an email to email@example.com (pretty generic email) saying that there was a security flaw in my website etc. etc
My initial reaction was that this was a scam. (How/why did they find our site.)
However, they didn't seem to be looking for money (so far) and they also had emailed it from a gmail account (which seemed off to me, spam is usually sent from weird domains) - also google marked it as important.
The overall writing is clearly not well educated, but it isn't as bad as they usually are.
The email address also seemed like a gamer addresses (some weird name and a few digits)
This is the email:
I have found a Web Application Vulnerability [XSS] in 'websitename.com' which can lead an attacker to perform unauthenticated tasks like account takeovers and other malicious stuffs like web defacement (your site), port scanning through your servers to other servers on internet or may use your website to spread Ransomware, and this bug is needed to be fixed as fast as possible.
Being a responsible security researcher, I m sending this mail directly to you without making the bug public, so if you are concerned about your website's security and want detailed information and Proof-of-Concept of this bug, please contact me on my mail - firstname.lastname@example.org
Would be happy to know - do you provide any rewards (bug bounty) / swag as token of appreciation for reporting bugs ?
-(Foreign sounding) Name
Italics have been changed for privacy
Is this a typical things that scammers would do?
If so what are they trying to gain, what would be (if any) the risks of replying to the email requesting some more information.
On the other hand, if it is in fact a legit "responsible security researcher" what kind of questions should I ask to find out.