Charles Schwab lookalike domains
Greyphish has recorded 686 domains that resemble Charles Schwab since February 2026, 21 of them in the last 90 days. Most of them (88%) are combosquats: Charles Schwab spelled correctly with a word added, most often “help”, “portal”. No single ending dominates: they are spread over 26, led by .sbs and .cyou. The pace is steady: 6 in the last 30 days, 6 in the 30 before. 1 certificate for unregistered .ph names (registry wildcard) is excluded: the registry answers for any name under that ending, so nobody had to register one to get a certificate for it.
Data as of . Public sources only.
What kind of lookalikes
One or two keystrokes away from the real name: a letter dropped, doubled, swapped or mistyped. More
A letter swapped for one that looks the same, in ASCII or in Unicode written as punycode. More
Words most often added to the name in the last 90 days: help (3), portal (3).
Lookalikes per week
Show as a table
| Week of | Typo | Combo | Homoglyph | Total |
|---|---|---|---|---|
| 2026-04-20 | 3 | 1 | 0 | 4 |
| 2026-04-27 | 0 | 1 | 0 | 1 |
| 2026-05-04 | 0 | 1 | 1 | 2 |
| 2026-05-11 | 1 | 1 | 0 | 2 |
| 2026-05-18 | 1 | 1 | 0 | 2 |
| 2026-05-25 | 2 | 3 | 0 | 5 |
| 2026-06-01 | 0 | 3 | 0 | 3 |
| 2026-06-08 | 0 | 1 | 0 | 1 |
| 2026-06-15 | 1 | 2 | 1 | 4 |
| 2026-06-22 | 0 | 0 | 0 | 0 |
| 2026-06-29 | 1 | 1 | 0 | 2 |
| 2026-07-06 | 0 | 3 | 0 | 3 |
| 2026-07-13 | 3 | 0 | 0 | 3 |
| 2026-07-20 | 0 | 2 | 0 | 2 |
| 2026-07-27 | 1 | 1 | 0 | 2 |
| 2026-08-03 | 1 | 0 | 0 | 1 |
| 2026-08-10 | 0 | 1 | 0 | 1 |
| 2026-08-17 | 1 | 1 | 0 | 2 |
| 2026-08-24 | 0 | 1 | 0 | 1 |
| 2026-08-31 | 0 | 1 | 0 | 1 |
| 2026-09-07 | 0 | 2 | 0 | 2 |
| 2026-09-14 | 0 | 1 | 0 | 1 |
| 2026-09-21 | 0 | 2 | 0 | 2 |
| 2026-09-28 | 0 | 2 | 0 | 2 |
| 2026-10-05 | 0 | 0 | 0 | 0 |
| 2026-10-12 | 0 | 1 | 0 | 1 |
Endings
The 8 most used of the 26 top-level domains these lookalikes sit under.
| Ending | Lookalikes | Share |
|---|---|---|
| .sbs | 181 | 26.4% |
| .cyou | 163 | 23.8% |
| .cfd | 112 | 16.3% |
| .com | 108 | 15.7% |
| .click | 88 | 12.8% |
| .de | 5 | 0.7% |
| .help | 3 | 0.4% |
| .net | 3 | 0.4% |
Where they are registered
For the 104 with a registrar in WHOIS (15% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Media Elite Holdings | 17 | 16.4% | Retail |
| GoDaddy | 14 | 13.5% | Retail |
| NameSilo | 7 | 6.7% | Retail |
| Gname | 6 | 5.8% | Retail |
| Tucows | 6 | 5.8% | Retail |
| Above.com | 5 | 4.8% | Retail |
| Dynadot | 5 | 4.8% | Retail |
| Cloudflare | 3 | 2.9% | Retail |
What the live ones do
95 of these lookalikes were registered and checked for a website and mail: 5 (5%) served a website and 5 (5%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.
Google Web Risk lists none of the 3 live ones checked against it.
3 were tracked while live and 0 have since gone down. See what to do about a lookalike.
Recent examples
The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Charles Schwab; it is not necessarily malicious, and none of these is a claim about who registered it or why.
schwabaccounting[.]netCombo, Oct 14Serves a websiteschwabonlineconnect[.]comCombo, Oct 3No site or mail when checkedschwab-help[.]xyzCombo, Oct 1Not checkedschwab3-support[.]my[.]idCombo, Sep 22No site or mail when checkedschwabhelp[.]sbsCombo, Sep 22Not checkedhelpschwab[.]comCombo, Sep 16Not checkedschwab-secure[.]esCombo, Sep 12Not checkedschwabportal[.]orgCombo, Sep 10Not checkedsecure-schwab[.]comCombo, Sep 5Not checkedc-schwab-portal[.]comCombo, Aug 27Not checked
Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.
Further reading
More in banking and payments
Greyphish is not affiliated with Charles Schwab. Domains listed resemble Charles Schwab by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.