If you have received an email claiming to be from Porkbun saying one of your domains is expiring, has already expired, or has been suspended over a payment problem, and something about it felt off, you were right.<\/p>\n\n\n\n
A large phishing campaign is currently impersonating us. The emails copy our layout and something close to our logo, and the link goes to a page built to capture your payment and account details. We have seen enough of them, and enough customers taken in by them, that we have emailed our entire customer base rather than waiting for people to find out the hard way.<\/p>\n\n\n\n
No Porkbun system has been compromised, and no customer data has leaked. We want to be plain about that, because “you received a targeted email” and “your data got out” feel identical from the receiving end, and they are not the same thing at all.<\/p>\n\n\n\n
This is not really about us, either. It is a persistent, industry-wide campaign that hits customers of every domain registrar, and it has been running in one form or another for years. The pretext rotates. The mechanics do not.<\/p>\n\n\n\n
Domain registration data is public by design. Anyone can look up which domains exist, who they are registered with, and often when they expire. From there the sender does not need your address: they guess the ones that tend to exist on any domain, and they scrape whatever is published on the domain’s own website. That is why one of these may have reached an address you never gave us, and why plenty of people are getting “Porkbun” notices for domains registered somewhere else entirely.<\/p>\n\n\n\n
We are reporting the domains and the pages behind them to the registrars and hosts involved, and filing for takedowns as fast as we can find them. That work is ongoing and it is genuinely helped by customer reports, because they show us addresses and variants we have not seen yet.<\/p>\n\n\n\n
We cannot stop the sending outright. Nobody in our position can. What we can do is make the fakes easy to recognize and get the infrastructure behind them pulled down quickly.<\/p>\n\n\n\n