purolator[.]packagevd[.]vip

Analysis of purolator.packagevd.vip indicates an active delivery-themed scam infrastructure registered on October 2, 2025, through Gname.com Pte. Ltd. As of July 29, 2026, the domain remains operational and is flagged by eight of ninety-one security vendors on VirusTotal, suggesting malicious intent. It appears on at least one security blocklist, specifically PhishDestroy, reinforcing its classification as a threat. The domain's naming convention—incorporating 'purolator' and 'package'—aligns with known tactics used in fraudulent parcel-tracking schemes, though the exact content and targeting methods remain unverified due to limited public telemetry.

Infrastructure review reveals no additional hosting or SSL certificate details, and no Safe Browsing or Open Threat Exchange (OTX) records were identified in the available data. The absence of further blocklist entries or community reporting does not diminish the risk; rather, it highlights the domain's potential to evade broader detection. Defenders should treat this domain as high-risk for delivery scams, particularly those impersonating logistics providers.

Network-level blocking is recommended, and organizations should monitor for connections to this domain in proxy or DNS logs. Further investigation into associated IP addresses, SSL certificates, or redirect chains may uncover additional infrastructure linked to this campaign.