purolator[.]packagec[.]vip

purolator.packagec.vip was registered on 30 September 2025 through Gname.com Pte. Ltd. The domain is currently active and has been classified as a high‑risk delivery‑scam infrastructure. Google Safe Browsing flags the domain for social engineering, indicating that the site is used to lure victims into divulging personal or payment information. Independent security aggregators have placed the domain on a single blocklist and PhishDestroy has issued a block, confirming its malicious reputation.

VirusTotal analysis shows that 13 of 91 scanning engines have identified the domain as malicious, providing additional corroboration of its threat profile. The combination of registrar information, safe‑browsing classification, blocklist inclusion, and multiple vendor detections demonstrates a consistent pattern of abuse despite the relatively low number of blocklist entries. The limited public infrastructure data, such as missing IP, SSL, or page‑title information, prevents a full attribution of hosting or payload delivery mechanisms.

Defenders should prioritize immediate containment by adding purolator.packagec.vip to DNS and web‑filter deny lists, enforce email gateway rules that block URLs containing the domain, and monitor network traffic for outbound connections to the associated IP space. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge.