shcwab[.]vip

The domain shcwab.vip is identified as a credential theft phishing site targeting American Express customers. Analysis confirms this domain operates under the guise of a legitimate financial services login portal, specifically mimicking the Charles Schwab brand as evidenced by its page title, 'Login | Charles Schwab.' This impersonation tactic is designed to deceive users into submitting sensitive login credentials, which are then harvested for fraudulent purposes. The domain is currently classified as an elevated-risk threat due to its active brand impersonation and confirmed malicious intent. Infrastructure analysis reveals several critical indicators of compromise. The domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. Security vendors have flagged shcwab.vip as malicious, with 22 out of 95 VirusTotal engines detecting it as a phishing threat. Additionally, the domain appears on one security blocklist and lacks an SSL certificate, further degrading its trustworthiness. The absence of encryption and its presence on a blocklist underscore the domain's high-risk nature and its use in credential harvesting campaigns. As of the latest assessment, shcwab.vip has been taken offline, mitigating immediate user exposure. However, the infrastructure and registration details suggest potential for reactivation or reuse in future campaigns. Organizations and users are advised to block the domain and its associated IP address (185.199.109.153) at the network level to prevent accidental access. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range. End-users should be educated on recognizing phishing attempts, particularly those impersonating financial institutions, and encouraged to verify domain authenticity before entering credentials. Proactive measures, such as implementing multi-factor authentication and domain monitoring, are recommended to mitigate risks associated with such threats.