schwarzman[.]co

Analysis of schwarzman.co indicates a high-risk phishing domain targeting financial or payment infrastructure, currently active as of July 25, 2026. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to IP address 104.21.61.85, hosted on Cloudflare's network (AS13335). The site returns an HTTP 301 redirect status, suggesting it may be part of a multi-stage phishing or redirection chain. The page title, 'Schwarzman - Global Payment Network,' implies an attempt to impersonate a payment or financial service, though no specific brand confirmation is available from the provided data.

Infrastructure analysis reveals the use of Cloudflare nameservers (dana.ns.cloudflare.com, jeff.ns.cloudflare.com) and technologies including Amazon Web Services, Amazon CloudFront, Unpkg, and Cloudflare Browser Insights, alongside HTTP/3 support. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious domains leveraging Cloudflare's proxy services. Detection metrics show the domain is flagged by three security blocklists (PhishDestroy, MetaMask, SEAL) and one of 95 security vendors on VirusTotal, though the latter alone does not confirm malicious intent without additional context. Defenders should treat this domain as actively hostile based on its presence on multiple blocklists and its payment-themed branding.

The HTTP 301 status may indicate an intermediate step in a phishing campaign, and the Cloudflare-hosted infrastructure complicates origin tracing. No evidence links this domain to a known phishing kit or specific threat actor, and the exact content or target of the phishing attempt remains unconfirmed. Network-level blocking or monitoring of connections to 104.21.61.85 is recommended until further analysis or takedown occurs.