Medium Severity
Brand impersonation: Charles Schwab
Description
Impersonation of Charles Schwab & Co
References
No references.
Sublime Security
Created Nov 25th, 2024 • Last updated Jun 3rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and (
// display name contains charles schwab
(
strings.ilike(strings.replace_confusables(sender.display_name),
'*charles schwab*'
)
// no spaces
or strings.ilike(strings.replace_confusables(sender.display_name),
'*charlesschwab*'
)
// levenshtein distince similar to schwab
or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
'charles schwab'
) <= 1
// sender domain contains schwab
or strings.ilike(strings.replace_confusables(sender.email.domain.domain),
'*schwab*'
)
)
)
// and the sender is not in org_domains or from charles shwab domains and passes auth
and not (
sender.email.domain.root_domain in $org_domains
or (
(
sender.email.domain.root_domain in (
"schwab.com",
"aboutschwab.com.",
"schwabcorrentesettlement.com", // Schawb v. Corrente, et al. Settlement domain
"schwabmoneywise.com",
"schwabe.com", // law firm with name
"proxyvote.com", // sends shareholder voting information with subject of company name
"boheme-schwabing.de", // steakhouse
"lesschwab.com", // tire sales
"schwab-marketing.com" // German Marketing Agency
)
or sender.email.domain.domain in ("schwabebooks.ccsend.com")
)
and headers.auth_summary.dmarc.pass
)
)
// and the sender is not from high trust sender root domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
Playground
Test against your own EMLs or sample data.