purolator[.]packagei[.]vip

The domain purolator.packagei.vip was registered on October 01, 2025 through Gname.com Pte. Ltd. The registration date places the domain well within the typical lifecycle of newly created malicious infrastructure. Since its appearance, the domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal analysis shows that seven out of ninety‑one scanned security vendors have flagged the domain, providing additional independent confirmation of its abusive nature. The limited number of detections suggests that the campaign may be in an early stage or that the domain is used in a targeted manner, reducing exposure to broader scanning.

No public IP address, hosting provider, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the underlying hosting infrastructure uncharacterized. Likewise, page‑title information, Safe Browsing status, and any associated malware kits have not been disclosed, so the exact content delivered to victims remains unknown. Defenders should proactively block purolator.packagei.vip at perimeter firewalls, DNS resolvers, and email gateways, and add the domain to internal blocklists.

Monitoring for any future appearances on additional blocklists or increased detection counts on VirusTotal is advised, as escalation could indicate broader distribution. Incident response teams should also consider correlating outbound traffic to the domain with user reports of delivery‑related scams, given the classification as a delivery scam. Continuous enrichment of the domain’s profile with host‑level data, SSL fingerprints, and content snapshots will improve attribution and mitigation efforts.