mfa[.]gypsyallied[.]com

This domain, mfa.gypsyallied.com, was identified as a credential theft operation targeting customers of Gypsy Allied Bank. The site presented a fraudulent login portal designed to harvest banking credentials, multi-factor authentication codes, and personal identification details. Infrastructure analysis reveals the use of PHP, Tailwind CSS, and Alpine.js, suggesting a dynamic front-end capable of real-time credential capture and exfiltration to attacker-controlled endpoints. The page title, 'Home - Gypsy Allied Bank,' confirms the impersonation of a legitimate financial institution, increasing the likelihood of successful social engineering attacks against unsuspecting users. Evidence supporting the malicious classification includes detection by 7 out of 95 security vendors on VirusTotal, with the domain appearing on at least 1 security blocklist. The domain was registered on February 21, 2026, through Cosmotown, Inc., and resolved to the IP address 161.97.121.66. Additional technical indicators include the use of Apache HTTP Server, StackPath CDN, and Smartsupp for potential live chat-based deception. The domain's trust score of 0/100 further corroborates its malicious intent, and it has since been taken offline following enforcement actions. Users who visited mfa.gypsyallied.com or entered credentials on the site should immediately revoke any active sessions with Gypsy Allied Bank and reset their passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor bank accounts for unauthorized transactions. If financial details were submitted, contact the bank to report potential fraud and consider placing a credit freeze. All affected devices should undergo a full security scan to detect any secondary payloads or persistent threats. Network administrators should block the domain and its associated IP (161.97.121.66) at the perimeter to prevent further exposure.