purolator[.]packagevi[.]vip

This domain is currently active and has been classified as a delivery‑scam operation. The registration record shows it was created on 03 October 2025 through the registrar Gname.com Pte. Ltd., a provider often used by malicious actors. Google Safe Browsing has issued a social‑engineering warning for the domain, indicating that the URL is being used to lure victims into disclosing personal or financial information. Independent analysis on VirusTotal reports that 12 out of 91 scanning engines flagged the domain as malicious, confirming a consensus of moderate‑to‑high malicious intent.

The domain also appears on a single public blocklist and is listed as blocked by the PhishDestroy feed, demonstrating that at least one external reputation service has taken remediation action. No public information is available regarding the hosting infrastructure, IP address, ASN, SSL certificate details, or HTTP response codes, and the page title has not been disclosed in the current intelligence set. Consequently, defenders cannot rely on host‑level indicators for detection, and must focus on DNS‑ and URL‑based controls.

Recommended mitigation steps include adding purolator.packagevi.vip to outbound and inbound firewall deny lists, configuring web‑proxy filters to block the domain, and updating email security gateways to reject any messages containing links to the domain. Security teams should also monitor DNS query logs for attempts to resolve the domain and consider sharing the indicator with threat‑intel platforms to accelerate collective blocking. Continuous re‑evaluation is advised, as further infrastructure details may emerge that could refine detection signatures.