Our security@ address at $dayjob gets about that many a month. Lots of folks blindly sending bug reports and “politely requesting a finder’s fee for disclosing properly.”

The shit of it is, they’ll all for stuff we don’t even use. IIS vuln reports when we only use Apache. Stuff like that.