umb-conect[.]com

This domain is flagged as a high-risk credential harvesting phishing site targeting UMB Direct users. Analysis indicates the threat specifically impersonates the UMB Direct login portal, likely to harvest banking or financial credentials from unsuspecting victims. The domain remains operational despite active security warnings, posing an immediate risk to users who may mistake it for a legitimate service. Infrastructure analysis reveals multiple concerning indicators. The domain umb-conect.com was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to IP address 87.251.64.218, hosted on AS200730 (ISAEV Igor) in Poland, an autonomous system with a history of hosting phishing infrastructure. The site lacks an SSL certificate, increasing the risk of interception or manipulation of user data. VirusTotal reports 11 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. The page title, UMB Direct Login, directly mimics the legitimate service, enhancing its deceptive appearance. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (87.251.64.218) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to umb-conect.com, particularly for employees or customers who may interact with UMB services. Users who may have visited the site should be instructed to reset their credentials for UMB Direct and any other services where passwords may have been reused. Network monitoring should be enhanced to detect any outbound connections to the domain or IP, as this may indicate successful credential harvesting or follow-on compromise. Security teams are advised to review logs for interactions with this domain and investigate any potential data exposure.