charles-schwab[.]vercel[.]app

This domain, charles-schwab.vercel.app, is actively impersonating the Charles Schwab financial services brand to conduct credential harvesting and account takeover attacks. The site presents a fraudulent login interface mimicking the legitimate Charles Schwab platform, targeting users with the intent to capture sensitive financial credentials, including usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the page title explicitly displays "Charles Schwab," reinforcing the social engineering pretext and increasing the likelihood of successful deception among unsuspecting users seeking legitimate financial services. Evidence supporting the malicious classification includes detection by 15 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources regarding its fraudulent nature. The domain is registered through Vercel Inc., a platform frequently abused for rapid deployment of phishing infrastructure due to its ease of use and free hosting capabilities. The site currently resolves to the IP address 216.198.79.67, located within Amazon.com, Inc.'s AS16509 network, and is SSL-certified by Google Trust Services (WR1), which may lend a false sense of legitimacy to victims. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its classification as active phishing infrastructure. Users who have visited charles-schwab.vercel.app or entered credentials on the site should immediately take corrective action to mitigate potential compromise. All exposed credentials must be considered compromised and should be changed without delay across all platforms where identical or similar login details may have been reused. Affected individuals are advised to enable multi-factor authentication on their financial accounts and monitor for unauthorized transactions or account activity. If financial information was entered, users should contact their financial institution to report potential fraud and request account monitoring or freezing. System scans using updated security tools are recommended to detect any secondary infections or data exfiltration attempts.