Hi there,
A large phishing campaign is impersonating Porkbun. These emails often claim that your domain is expiring soon, expired, or has been suspended due to a payment issue, and include a link to resolve the issue. These links lead to fake pages designed to steal your payment and account information.
Please be assured that this is not a result of a breach of Porkbun systems, nor is it an issue specific to your Porkbun account security. This is a persistent, industry-wide phishing campaign targeting customers across all domain registrars. Unfortunately there is no way for us to stop them entirely. They seem to be using public WHOIS data to correlate domains to registrars, and then blasting out their phishing email to generic email addresses associated with those domains such as info@, contact@, etc. Additionally, they sometimes scrape website data which can include your email address.
We are doing all we can to report the domains being used to perpetuate abuse to the registrars and hosts involved. Since this is a larger campaign than we have ever seen and we are aware of customers being tricked into paying these criminals, we are sending this notice to all customers.
A few things to know:
How to spot them: They come from random third-party addresses, not from
porkbun.com. Legitimate Porkbun support email comes only from
[email protected]. The fake emails use generic greetings like "Dear customer" and link to domains that have nothing to do with Porkbun. CISA publishes a guide on avoiding social engineering and phishing attacks:
Avoiding Social Engineering and Phishing Attacks.
What to do: Don't click links in any email claiming your domain or service is suspended. Instead, go directly to
porkbun.com, log in, and check your account. If a renewal actually needs your attention, you'll see it there.
If you receive one of these emails, you can forward it to us at
[email protected]. The full original (.eml) format is most helpful. Every report helps us get these sites taken down faster.
We also keep a fuller guide to spotting fake emails, including how to see the real sender in your mail app, at
porkbun.com/security.
And if you're ever unsure whether an email is really from us, just ask. We'd much rather verify a real one than have you click a fake one.
Thank you,
The Porkbun Team