Porkbun
Summary
Porkbun LLC is a legitimate ICANN-accredited domain registrar founded circa 2014-2015, headquartered in Sherwood, Oregon, and managing over 3.45 million domains. While the company is not itself a scam operation, it has attracted scrutiny from the crypto security community — including on-chain investigator ZachXBT — for hosting phishing infrastructure linked to Angel Drainer and Inferno Drainer wallet-draining services, including fake Ledger sites. Third-party tracking platforms document hundreds of flagged phishing domains registered through Porkbun and allege that the company's abuse-response enforcement has been inadequate, with a majority of reported domains remaining active after formal abuse reports.
Connected Entities
1 entitiesTimeline(8 events)
2014-01-01
Porkbun LLC founded by Ray King and Peter Brual in Portland/Sherwood, Oregon as a subsidiary of Top Level Design LLC. ICANN accreditation received, IANA Registrar ID 1861 assigned.
ICANNWiki / Porkbun About Us2023-03-01
Angel Drainer phishing-as-a-service begins operations, deploying lookalike crypto brand domains (Ledger, Coinbase, WalletConnect) across multiple registrars including Porkbun.
Web3 Crypto Malware: Angel Drainer - Sucuri Blog2023-12-14
Ledger Connect Kit supply-chain exploit uses Angel Drainer to drain approximately $484,000-$610,000 from DeFi users within two hours. ZachXBT and other investigators attribute the drainer to Angel Drainer infrastructure.
CoinDesk - Ledger Exploit Drained $484K2024-06-24
Porkbun announces it has crossed 2 million domains under management, becoming the 20th largest ICANN registrar overall.
BusinessWire - Porkbun.com Now Manages Over 2 Million Domain Names2024-10-18
Scam Sniffer reports on-chain data showing Inferno Drainer's fee address changed, with Inferno Drainer claiming Angel Drainer has taken over the entire project.
Scam Sniffer on X2026-01-02
PhishDestroy begins systematic abuse report filings against phishing domains registered through Porkbun LLC. Tracking covers 274 domains; 71% remain active after reports filed.
PhishDestroy - Porkbun LLC registrar page2026-04-08
Phishing domain chatdefi.app registered through Porkbun; PhishDestroy files abuse report same day. Domain remains reachable over one month later with drainer kit active.
PhishDestroy - chatdefi.app domain report2026-05-01
Porkbun's official Twitter account responds to security firm Coinspect, stating it has contacted its abuse department and that a reported phishing domain was suspended. Dark Web Informer confirms the takedown.
Porkbun on X / Dark Web Informer on XResearch Gaps
1 open · agent-resolvableHeuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.
- [med]unarchived sources
Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.
Decision Log
- hash: HTaCZNXJuYbLBkyjwymdD3yJzUSySYgXpTHwkmhN9krX
- hash: BeSgdhbzBVGray4CTHSWnswGUKr4ssZAKUMBq3qM5LYV
- hash: 8CtvFHTXWE96js3At7kXmXQstn15vmmDpYzzStynXib8
- hash: Hdn9H2x44VZxhf5561sDRyeNipiZP84qTEiZjXNK6V6V
- hash: 5YgjctTUS6k3c65wqc3WC74s3KHKxnophHTCewyhRVdz
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet
generated: 5/4/2026, 4:05:03 PM
last updated: 6/14/2026, 11:15:57 PM
avoid.net — verified advice for a post-truth world