purolator[.]packagevm[.]vip

This domain is flagged as a high-risk delivery scam targeting Purolator brand. Analysis of the available evidence shows multiple indicators of malicious intent. The domain was registered on October 04, 2025, through Gname.com Pte. Ltd., a registrar often associated with disposable or high-risk domains. VirusTotal detection is significant: 13 of 91 security vendors flag this domain as malicious or suspicious. Google Safe Browsing specifically flags it for social engineering, which aligns with the delivery scam classification.

The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, a phishing protection service. The domain name itself leverages the legitimate Purolator brand by inserting 'purolator' followed by 'packagevm.vip', a structure commonly seen in brand impersonation scams that trick users into believing they are visiting a legitimate package tracking site. The domain creation date of October 04, 2025, combined with the report date of July 29, 2026, indicates it has been active for approximately 10 months. The exact page content and infrastructure details such as ASN, hosting IP, and SSL certificate status are not available in the current intelligence, so the specific scam mechanism (e.g., credential harvesting, malware delivery, or payment theft) cannot be confirmed.

Defenders should treat this domain as actively malicious. Recommended actions include blocking the domain at network and email gateways, adding it to threat intelligence feeds, and monitoring for related domains using the same naming pattern. Users should be warned not to interact with any messages or links referencing purolator.packagevm.vip. Further investigation is warranted to identify the hosting infrastructure and any associated domains for broader takedown efforts.