purolator[.]packagevc[.]vip

Analysis of purolator.packagevc.vip indicates active delivery‑related fraud infrastructure. The domain was created on October 02, 2025 and is registered through Gname.com Pte. Ltd., a registrar frequently observed in malicious deployments. VirusTotal scans have yielded 13 detections out of 91 security vendors, reflecting a moderate level of consensus among scanning engines that the site hosts malicious content.

The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken remediation action. The threat is classified as a delivery scam, and the risk level is elevated, suggesting that the actors behind the domain are attempting to harvest credentials or payment information under the guise of a package notification. Current intelligence does not disclose the hosting IP address, ASN, or TLS certificate details, and no additional page‑title or brand information has been released.

Defenders should add purolator.packagevc.vip to network‑level blocklists, enforce DNS sinkholing where possible, and monitor outbound connections for any attempts to resolve or contact the domain. Continuous re‑scanning through multi‑vendor platforms is advised to capture any changes in detection posture, and security teams should flag any email or SMS messages referencing purolator.packagevc.vip for further forensic examination. Given the observed detection count and blocklist activity, proactive containment is warranted to mitigate potential credential‑theft or monetary loss.