Description

Impersonation of Charles Schwab & Co

References

No references.

Sublime Security
Created Nov 25th, 2024 • Last updated Jun 3rd, 2025
Source
type.inbound
and (
  // display name contains charles schwab
  (
    strings.ilike(strings.replace_confusables(sender.display_name),
                  '*charles schwab*'
    )
    // no spaces
    or strings.ilike(strings.replace_confusables(sender.display_name),
                     '*charlesschwab*'
    )
    // levenshtein distince similar to schwab
    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                            'charles schwab'
    ) <= 1
    // sender domain contains schwab
    or strings.ilike(strings.replace_confusables(sender.email.domain.domain),
                     '*schwab*'
    )
  )
)

// and the sender is not in org_domains or from charles shwab domains and passes auth
and not (
  sender.email.domain.root_domain in $org_domains
  or (
    (
      sender.email.domain.root_domain in (
        "schwab.com",
        "aboutschwab.com.",
        "schwabcorrentesettlement.com", // Schawb v. Corrente, et al. Settlement domain
        "schwabmoneywise.com",
        "schwabe.com", // law firm with name
        "proxyvote.com", // sends shareholder voting information with subject of company name
        "boheme-schwabing.de", // steakhouse
        "lesschwab.com", // tire sales
        "schwab-marketing.com" // German Marketing Agency
     )
      or sender.email.domain.domain in ("schwabebooks.ccsend.com")
    )
    and headers.auth_summary.dmarc.pass
  )
)
// and the sender is not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.