purolator[.]packageva[.]vip

Analysis of purolator.packageva.vip indicates an active delivery scam domain registered on October 2, 2025, through Gname.com Pte. Ltd. As of July 29, 2026, the domain remains operational and is flagged by 12 of 91 security vendors on VirusTotal, suggesting malicious intent. It appears on at least one security blocklist and is explicitly blocked by PhishDestroy, reinforcing its classification as a threat.

The domain's structure, incorporating 'purolator' and 'package,' aligns with known tactics used in courier or parcel delivery scams, though the exact content of the site has not been verified. No hosting provider, IP address, or SSL certificate details are currently available in the supplied intelligence, limiting further infrastructure attribution.

Defenders should treat this domain as high-risk for phishing or fraudulent delivery notifications, particularly given its recent creation and active detection by multiple security vendors. Organizations are advised to block access to this domain at the network level and monitor for related indicators of compromise, such as associated email campaigns or secondary domains registered under the same registrar.