tally[.]vistashopee[.]com

Analysis of tally.vistashopee.com shows an active high‑risk brand‑impersonation campaign targeting ShopeePay. The domain was registered on April 9, 2026 through GoDaddy.com, LLC and resolves to IP 142.44.140.148, which is hosted in Canada by OVH Hosting, Inc. DNS resolution uses the GoDaddy nameservers ns47.domaincontrol.com and ns48.domaincontrol.com. The site presents an HTTP 200 response and advertises a page title "- App"; no further content has been publicly disclosed. Google Safe Browsing has flagged the URL for SOCIAL_ENGINEERING, and VirusTotal reports 11 of 94 security vendors flagging the domain as malicious. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The TLS certificate is issued by Sectigo Limited under a Sectigo RSA Domain Validation Secure Server CA, indicating a valid but possibly purchased certificate. The domain is currently blocked by PhishDestroy and appears on one additional security blocklist. Defenders should add the domain and its resolving IP to outbound and inbound blocklists, monitor for related traffic patterns, and advise users against any interaction with the URL. Continuous re‑evaluation is recommended, as further payload or credential‑harvesting mechanisms have not been observed in the public data.