ww4-umb[.]com

This domain, ww4-umb.com, is actively impersonating the UMB Direct login portal to harvest user credentials. Visitors to the site are presented with a fraudulent login interface designed to mimic the legitimate UMB Direct banking platform, tricking users into entering sensitive account details such as usernames, passwords, and potentially multi-factor authentication codes. The site poses a significant risk of financial fraud, identity theft, and unauthorized account access for individuals or organizations associated with UMB Bank. Analysis indicates the domain was registered on July 06, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. As of the latest assessment, 15 out of 95 security vendors on VirusTotal have flagged the domain as malicious, confirming its use in phishing operations. The site resolves to the IP address 87.251.64.218 and uses a Let's Encrypt SSL certificate, which provides a false sense of security to unsuspecting users while encrypting stolen data in transit. If you or someone in your organization has visited ww4-umb.com or entered credentials on this site, immediate action is required. First, change the compromised passwords for UMB Bank and any other accounts where the same credentials may have been reused. Enable multi-factor authentication if not already active. Monitor all linked financial accounts for unauthorized transactions and report any suspicious activity to UMB Bank’s fraud department. Additionally, run a full scan of the device used to access the site to detect potential malware or keyloggers. Organizations should block the domain and its associated IP address at the network level to prevent further exposure.