Security Scan Report: content.schwabplan.com

Redirected to:
https://workplace.schwab.com/
Site favicon
Submitted: Jun 3, 2026, 7:32:38 PMCompleted: Jun 3, 2026, 7:33:28 PMpubliccompleted
Loading additional data...

Summary

This website contacted 2 IPs in 1 country across 2 domains to perform 2 HTTP transactions. The main domain is workplace.schwab.com and was registered NaN years ago.

Submitted URL: https://content.schwabplan.com

Effective URL: https://workplace.schwab.com/Redirected

The Cisco Umbrella rank of the primary domain is #139,272 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 85%

9
Risk Score

The site impersonates Schwab, has a low‑rank domain, redirects to another subdomain, and triggers a critical malware C2 alert – avoid interaction and report.

Risk Factors
Brand impersonation with low‑rank domain
Critical malware IDS alert (C2 communication)
Cross‑domain redirect to a different subdomain
Presence of numerous third‑party external resources
Domain age information unavailable

Details

Page Title

RPS Homepage | Retirement Plan Services

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

finance banking

(28%)

Domain Information

The domain name 'content.schwabplan.com' uses the commercial generic top-level domain (.com) and includes subdomain 'content'. The second-level label 'schwabplan' is 10 characters long containing two vowels alongside 8 consonants. Tokenizing the label suggests three words: schwa, b, plan. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://content.schwabplan.com

Page Load Overview

6.67s
Total Load Time
76
HTTP Requests
18
Domains
2.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:8,909 chars
Detector Agreement:75%

Website Classification

Primary Category

finance banking28% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
28%
forum
20%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3892.123.104.8Frankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
3892.123.104.20Frankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
762--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17144505B79A0371ADAD38368AA627A98B910984FFD375CDCF14C57784FCDBE14C0620A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:NST5UE+GcWOkYnpWRad+byb8+cP4pVMz9JAsjKtMB3i9UWJ3DXHvPF8+Yh:NrrGcFvd+8pVxMN0UWJ7Q

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:270908:AGAASCSYCGiGHvAaD+CLBKG20QgPx/kYTCQZMRiEByKAAG6cAKhcg0AFZAaERYjBVuBEAFGEFQHABhxIMRGQDD3gNRxgF0sS

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ff818181ffffff
Perceptual Hash:bd3892436d6e1c39
Difference Hash:c13b3b23232a0f0b
Wavelet Hash:0083818181ffefff
Color Hash:#938c1f

Scan History

Scan history not available

Unable to load historical scan data