# PhishDestroy domain threat record: charless-schwab.live Content language: English Canonical HTML report: https://phishdestroy.io/domain/charless-schwab.live/ Machine-readable companion: https://phishdestroy.io/domain/charless-schwab.live/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:15:54 UTC - Last availability or vendor check: 2026-10-26 16:15:54 UTC - Stored record updated: 2026-10-26 20:14:32 UTC - VirusTotal detections in the stored snapshot: 8/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: OpenPhish - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: schwab ## Stored infrastructure - Observed IP address: 192.142.48.98 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a178fe-60d5-7539-8dc3-ed87bed836c9/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/charless-schwab.live - Certificate Transparency search: https://crt.sh/?q=%25.charless-schwab.live - Web Archive lookup: https://web.archive.org/web/*/https://charless-schwab.live/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot dated 2026-10-26 shows a page branded as Charles Schwab, with a purple hero banner, top links for Cookie Policy, Privacy Policy and Terms Service, a Contact button, and a side menu offering Log In, Open an Account, Find a Branch, Contact Us and Chat beside an offer of zero-equity-commission brokerage and retirement accounts. PhishDestroy listed it as a credential phishing page and first saw it on 2026-10-26. How the scam works The page mimics a brokerage login and account-opening flow, so a visitor who enters credentials into the spoofed Charles Schwab interface hands them to whoever controls the page. As a category risk, such lookalike login screens harvest usernames, passwords and follow-up account details instead of providing the advertised service. Evidence The captured screenshot shows the Charles Schwab name in the header and hero, a Contact button, a Log In menu item, and the zero-commission brokerage offer. urlscan scored the capture malicious with an ML score of 93 and a phishing category tagging Charles Schwab on 2026-10-26, and its scan recorded an HTTP-to-HTTPS 307 redirect funnel; its overall score reached 100 in the phishing category. VirusTotal flagged the domain as malicious, with ESET, Fortinet, Netcraft and OpenPhish labelling it phishing, on 2026-10-26. Spamhaus listed the domain under its spam category, OpenPhish and PhishDestroy's internal blocklist listed it, OTX recorded 3 pulses, Cloudflare Radar marked it phishing with newly seen domain risks, while Google Safe Browsing did not flag it on 2026-10-26; site inspection recorded a WordPress-style stack through globals such as wp, twemoji and _wpemojiSettings, zero tracker requests, and 4 distinct script SHA256 hashes for campaign pivoting, one beginning 726ac59577c8. Infrastructure The domain was registered on 2026-10-25 through NICENIC INTERNATIONAL GROUP CO., LIMITED and its A record pointed to AS-ULTAHOST, Ultahost, Inc., with no WAF or CDN shown in the capture. Notable weaknesses lead the posture: CSP, HSTS and strict-transport, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; SPF, DKIM and DMARC present; CAA present; DNSSEC unsigned. What to do A visitor who submitted credentials should change that password on the genuine Charles Schwab service, enable two-factor authentication, and watch for follow-up contact requesting more details. Security teams should block charless-schwab.live, distribute the script hashes and source verdicts, and treat comparable lookalike login pages as phishing. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a178fe-60d5-7539-8dc3-ed87bed836c9/ Cloudflare Radar report: https://radar.cloudflare.com/scan/885875db-d18f-4d8a-9678-377a95002acd URLQuery report: https://urlquery.net/report/def19569-3806-4ee2-a275-6ae463fb271d Stored capture screenshot: https://i.ibb.co/m5WK8X8X/c9a68cd768e1.png Cloudflare Radar screenshot (2026-10-26T16:48:26Z): https://screenshots.phishdestroy.io/cf/885875db-d18f-4d8a-9678-377a95002acd.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/def19569-3806-4ee2-a275-6ae463fb271d.png URLScan screenshot (2026-10-26T07:56:09Z): https://screenshots.phishdestroy.io/us/01a17735-6e57-779a-ab41-78f7f7a5c673.png URLScan capture report: https://urlscan.io/result/01a17735-6e57-779a-ab41-78f7f7a5c673/ URLScan screenshot (2026-10-26T08:05:39Z): https://screenshots.phishdestroy.io/us/01a1773e-4150-77ac-9960-0f5b6f0b4934.png URLScan capture report: https://urlscan.io/result/01a1773e-4150-77ac-9960-0f5b6f0b4934/ URLScan screenshot (2026-10-26T08:35:55Z): https://screenshots.phishdestroy.io/us/01a17759-efcb-7579-a3a5-4cd8735c7df2.png URLScan capture report: https://urlscan.io/result/01a17759-efcb-7579-a3a5-4cd8735c7df2/ URLScan screenshot (2026-10-26T08:55:29Z): https://screenshots.phishdestroy.io/us/01a1776b-df98-71ed-a991-56c0d6232741.png URLScan capture report: https://urlscan.io/result/01a1776b-df98-71ed-a991-56c0d6232741/ URLScan screenshot (2026-10-26T16:31:10Z): https://screenshots.phishdestroy.io/us/01a1790c-a913-72a9-99d8-c81fbc311d37.png URLScan capture report: https://urlscan.io/result/01a1790c-a913-72a9-99d8-c81fbc311d37/ VirusTotal report: https://www.virustotal.com/gui/domain/charless-schwab.live Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=charless-schwab.live Archived copy: https://web.archive.org/web/20261026161600/https://charless-schwab.live/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 20:14:32 UTC ## Stored page captures - Primary capture: https://i.ibb.co/m5WK8X8X/c9a68cd768e1.png Captured: 2026-10-26 16:15:54 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a178fe-60d5-7539-8dc3-ed87bed836c9.png Captured: 2026-10-26 16:15:54 UTC Source report: https://urlscan.io/result/01a178fe-60d5-7539-8dc3-ed87bed836c9/ - URLScan capture 2: https://urlscan.io/screenshots/01a17885-9787-7655-aef5-cf67eb9746e4.png Captured: 2026-10-26 16:14:42 UTC Source report: https://urlscan.io/result/01a178fe-60d5-7539-8dc3-ed87bed836c9/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17735-6e57-779a-ab41-78f7f7a5c673.png Captured: 2026-10-26 07:56:09 UTC Source report: https://urlscan.io/result/01a17735-6e57-779a-ab41-78f7f7a5c673/ SHA-256: ffe40734492e1b7f0177b074170a483522932b5222b5fd7e8562ebeecfba36b5 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1773e-4150-77ac-9960-0f5b6f0b4934.png Captured: 2026-10-26 08:05:39 UTC Source report: https://urlscan.io/result/01a1773e-4150-77ac-9960-0f5b6f0b4934/ SHA-256: ffe40734492e1b7f0177b074170a483522932b5222b5fd7e8562ebeecfba36b5 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17759-efcb-7579-a3a5-4cd8735c7df2.png Captured: 2026-10-26 08:35:55 UTC Source report: https://urlscan.io/result/01a17759-efcb-7579-a3a5-4cd8735c7df2/ SHA-256: ffe40734492e1b7f0177b074170a483522932b5222b5fd7e8562ebeecfba36b5 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1776b-df98-71ed-a991-56c0d6232741.png Captured: 2026-10-26 08:55:29 UTC Source report: https://urlscan.io/result/01a1776b-df98-71ed-a991-56c0d6232741/ SHA-256: ffe40734492e1b7f0177b074170a483522932b5222b5fd7e8562ebeecfba36b5 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790c-a913-72a9-99d8-c81fbc311d37.png Captured: 2026-10-26 16:31:10 UTC Source report: https://urlscan.io/result/01a1790c-a913-72a9-99d8-c81fbc311d37/ SHA-256: ffe40734492e1b7f0177b074170a483522932b5222b5fd7e8562ebeecfba36b5 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/885875db-d18f-4d8a-9678-377a95002acd.png Captured: 2026-10-26 16:48:26 UTC Source report: https://radar.cloudflare.com/scan/885875db-d18f-4d8a-9678-377a95002acd SHA-256: 125b849556a634e96bb6ea91b2440131828d8bda1b91b0ff5d74d795fef8795d - URLQuery: https://screenshots.phishdestroy.io/uq/def19569-3806-4ee2-a275-6ae463fb271d.png Source report: https://urlquery.net/report/def19569-3806-4ee2-a275-6ae463fb271d SHA-256: 3b5b5b60c1aeefe1814b53a4284fed468fe3cc0b1cc1e4bc8c8cf28d7920669a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T16:33:12Z", "uuid": "01a178fe-60d5-7539-8dc3-ed87bed836c9", "scanned_at": "2026-10-26T16:15:07Z", "final_url": "https://charless-schwab.live/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://charless-schwab.live/", "from": "http://charless-schwab.live/", "status": 307 } ], "ip": "192.142.48.98", "domains": [ "cdn.optimizely.com", "www.schwab.com" ], "ips": [ "2606:4700::6812:4239", "192.142.48.98" ], "asns": [ "13335", "398256" ], "countries": [ "US", "ZA" ], "link_domains": [ "www.schwab.com", "schwab.com", "client.schwab.com", "advisorservices.schwab.com", "franchise.schwab.com", "www.schwabfunds.com", "www.schwabworkplaceservices.com", "brokercheck.finra.org", "www.aboutschwab.com", "www.schwabjobs.com", "www.schwabmoneywise.com", "www.schwab.com.hk", "www.schwab.co.uk", "international.schwab.com", "www.stockbrokers.com", "www.sipc.org", "www.youtube.com", "twitter.com", "www.facebook.com", "www.linkedin.com" ], "social": [ "https://www.youtube.com/channel/UCToe3dspZyw2L_JY-JmP3Mw", "https://twitter.com/charlesschwab", "https://www.facebook.com/CharlesSchwab" ], "doc_hash": "a1ddf6fb7133a7fbf9fb12fd92558325ee503cb891b933b3905069239cf737d6", "script_hashes": [ "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3", "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3", "e6532df7c0a3c44b964372202907425b791ba38d8d3a0754f8b36bc35c5c7873", "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3" ], "globals": [ "_wpemojiSettings", "twemoji", "wp", "acaiAnimations" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "autoconfig.charless-schwab.live", "autoconfig.eset-home-eset.site", "autodiscover.charless-schwab.live", "autodiscover.eset-home-eset.site", "charless-schwab.live", "charless-schwab.live.eset-home-eset.site", "cpanel.charless-schwab.live", "cpanel.eset-home-eset.site", "cpcalendars.charless-schwab.live", "cpcalendars.eset-home-eset.site" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "cpanel.charless-schwab.live", "protocol": "TLS 1.3", "valid_to": "2027-01-23T01:59:47Z", "valid_from": "2026-10-25T01:59:48Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 1, "tls_valid_days": 89, "requests": 31, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 93, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "schwab" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Charles Schwab" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:48:58Z", "uuid": "885875db-d18f-4d8a-9678-377a95002acd", "scanned_at": "2026-10-26T16:48:26Z", "final_url": "https://charless-schwab.live/", "status": 200, "history": [ { "url": "https://charless-schwab.live/", "status": 200 } ], "dom_hash": "d131e33255749cdb4bfff6f078ba8de485c4fa43f8303cc4b815ce9e01813e20", "doc_hash": "a1ddf6fb7133a7fbf9fb12fd92558325ee503cb891b933b3905069239cf737d6", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "Phishing", "Security threats", "New Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "charless-schwab.live", "type": "A", "value": "192.142.48.98" } ], "dnssec_valid": false, "ip": "192.142.48.98", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-25T02:02:06Z", "updated": "2026-10-25T02:16:28Z", "expires": "2027-10-25T02:02:06Z", "nameservers": [ "ns1.ultahost.com", "ns2.ultahost.com", "ns3.ultahost.com", "ns4.ultahost.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T16:47:30Z", "analysis_at": "2026-10-26T09:08:24Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 7, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "suspicious", "OpenPhish": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-10-25T03:01:58Z", "dns": [ { "ttl": 14400, "type": "A", "value": "192.142.48.98" }, { "ttl": 14400, "type": "MX", "value": "charless-schwab.live", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns2.ultahost.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:192.142.48.98 include:relay.mailchannels.net ~all" }, { "ttl": 21600, "type": "NS", "value": "ns4.ultahost.com" }, { "ttl": 21600, "type": "SOA", "rname": "hosting-notify.ultahost.com", "value": "ns1.ultahost.com" }, { "ttl": 21600, "type": "NS", "value": "ns1.ultahost.com" }, { "ttl": 21600, "type": "NS", "value": "ns3.ultahost.com" } ], "dns_at": "2026-10-26T09:08:43Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "autoconfig.charless-schwab.live", "autoconfig.eset-home-eset.site", "autodiscover.charless-schwab.live", "autodiscover.eset-home-eset.site", "charless-schwab.live", "charless-schwab.live.eset-home-eset.site", "cpanel.charless-schwab.live", "cpanel.eset-home-eset.site", "cpcalendars.charless-schwab.live", "cpcalendars.eset-home-eset.site" ], "issuer": "Let's Encrypt / YR2", "serial": "50bfd253429f3222294d5b984b478460427", "sha256": "3594a706d6b7d54629693a519bc6bf71c03d90f326c24c10796d0f55062972c4", "subject": "cpanel.charless-schwab.live", "valid_to": "2027-01-23T01:59:47Z", "valid_from": "2026-10-25T01:59:48Z" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-24T16:00:00Z", "registration": "2026-10-24T16:00:00Z", "registrar expiration": "2027-10-24T16:00:00Z", "last update of RDAP database": "2026-10-25T03:01:49Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:49:12Z", "mail_config": { "mx": [ "charless-schwab.live" ], "spf": "v=spf1 +a +mx +ip4:192.142.48.98 include:relay.mailchannels.net ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "charless-schwab.live" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T16:16:00Z", "first": "2026-10-26T16:16:00Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 25605 }, "robots_txt": { "agents": [ "*" ], "present": true, "llms_txt": true, "sitemaps": [ "https://charless-schwab.live/sitemap_index.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "ogUrl": "https://charless-schwab.live/", "title": "Charles Schwab - Login Your Charles Schwab Account", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogTitle": "Charles Schwab - Login Your Charles Schwab Account", "generator": "WordPress 7.1.3", "ogSiteName": "Charles Schwab", "description": "Login Your Charles Schwab Account", "twitterCard": "summary_large_image", "canonicalUrl": "https://charless-schwab.live/", "ogDescription": "Login Your Charles Schwab Account" }, "trackers": { "requests": 0 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 97, "wait": 1170, "connect": 95, "download": 265 }, "response_ms": 1629 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 122458, "co2_grams": 0.0045, "cleaner_than": 18 }, "dns_server": { "ns": [ { "ip": "149.28.254.81", "host": "ns4.ultahost.com" }, { "ip": "51.38.114.43", "host": "ns2.ultahost.com" }, { "ip": "167.71.73.238", "host": "ns1.ultahost.com" }, { "ip": "94.130.75.18", "host": "ns3.ultahost.com" } ], "zone": "charless-schwab.live" }, "location": { "ip": "192.142.48.98", "asn": "398256", "org": "Ultahost, Inc.", "city": "New York", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "cpanel.charless-schwab.live" }, "dns": { "A": [ "192.142.48.98" ], "MX": [ "{\"exchange\": \"charless-schwab.live\", \"priority\": 0}" ], "NS": [ "ns3.ultahost.com", "ns1.ultahost.com", "ns2.ultahost.com", "ns4.ultahost.com" ], "SOA": "{\"nsname\": \"ns1.ultahost.com\", \"hostmaster\": \"hosting-notify.ultahost.com\", \"serial\": 2026102507, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:192.142.48.98 include:relay.mailchannels.net ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "192.142.48.98", "family": 4 }, "redirects": { "chain": [ "https://charless-schwab.live" ] }, "linked_pages": { "external": [ "https://www.schwab.com/open-an-account", "https://www.schwab.com/invest-with-us/self-directed-investing", "https://www.schwab.com/trading", "https://www.schwab.com/intelligent-portfolios", "https://www.schwab.com/invest-with-us/wealth-management-services", "https://www.schwab.com/pricing", "https://www.schwab.com/satisfaction-guarantee", "https://www.schwab.com/learn/market-commentary", "https://www.schwab.com/learn/planning", "https://www.schwab.com/learn/trading", "https://brokercheck.finra.org/", "https://www.schwab.com/mobile", "https://www.aboutschwab.com/", "https://www.schwabjobs.com/", "https://www.schwab.com.hk/", "https://www.schwab.co.uk/", "https://international.schwab.com/", "http://www.sipc.org/", "https://www.schwab.com/", "https://www.schwab.com/", "https://www.schwab.com/", "https://www.schwab.com/branches", "https://www.schwab.com/learn", "https://www.schwab.com/", "https://www.schwab.com/checking/investor-checking-offer" ], "external_count": 90, "internal_count": 7 }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } } } } ```