purolator[.]packageh[.]vip

Analysis of the domain purolator.packageh.vip indicates active involvement in a delivery scam campaign as of July 29, 2026. The domain was registered on October 1, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Google Safe Browsing has flagged this domain for social engineering, a classification consistent with phishing or fraudulent activity targeting users through deceptive messaging. The domain appears on at least one security blocklist, specifically PhishDestroy, which further corroborates its malicious classification.

VirusTotal scanning results show that 14 out of 91 security vendors have flagged purolator.packageh.vip as malicious, reflecting a moderate but significant level of consensus among detection engines. The absence of additional details regarding hosting infrastructure, autonomous system number (ASN), or associated IP addresses limits further attribution at this stage. However, the combination of registrar reputation, blocklist presence, and vendor detections strongly suggests that this domain is part of an ongoing phishing operation. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels.

Given the domain's association with delivery scams, organizations should also monitor for related phishing emails or SMS messages that may direct users to this URL. While the exact content of the site has not been analyzed, the available evidence aligns with tactics commonly used to impersonate logistics or courier services. No legitimate use case for this domain has been identified, and its continued operation poses a direct threat to end-users. Further investigation into associated infrastructure, such as nameservers or connected domains, may provide additional context for mitigation efforts.