ops[.]swankyscoop[.]net

Analysis of ops.swankyscoop.net, created on February 22, 2026 and hosted by Namecheap, Inc. (AS22612) in the United States, shows an active credential‑phishing campaign as of the report date, July 25, 2026. The domain resolves to IP address 199.188.200.95 and uses the namecheaphosting.com name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. The site presents the page title "Log In ‹ Swank Tracker — WordPress" and runs a typical WordPress stack with MySQL, PHP, LiteSpeed, Underscore.js and jQuery. An SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 is present, but the HTTP response is a 302 redirect, a pattern often used to conceal phishing pages.

Google Safe Browsing classifies the domain under social engineering, and PhishDestroy has listed it on a security blocklist, confirming that at least one dedicated anti‑phishing feed is actively blocking the host. VirusTotal reports nine of ninety‑five scanning engines flagging the domain, reinforcing the malicious classification. The Gridinsoft trust score of 0 out of 100 further indicates a lack of reputation.

While the page title suggests a login portal, the exact content of the page has not been captured, leaving the specific credential‑capture mechanism uncertain. Defenders should add ops.swankyscoop.net to network and endpoint blocklists, monitor DNS queries for the domain, and consider sinkholing the associated IP range. Continued observation of the SSL certificate and any changes in redirect behavior is advised, as is periodic re‑scanning with multi‑engine services to capture emerging detections.