capcut[.]com[.]in

This domain, capcut.com.in, is identified as a generic phishing site designed to distribute a malicious Android application package (APK) under the false pretense of offering CapCut Pro Video Editor version 16.2.1. The site impersonates the legitimate CapCut brand, a well-known video editing software, to deceive users into downloading and installing malware. As of the latest analysis, the domain is currently offline, but prior activity indicates a clear intent to exploit users seeking free or premium software versions. Analysis indicates the domain was flagged by 7 out of 95 security vendors on VirusTotal, a clear indicator of malicious intent. It was registered through the National Informatics Centre on February 21, 2026, an unusually future date suggesting potential domain spoofing or incorrect registration details. The domain resolved to the IP address 188.114.97.3 and was hosted behind Cloudflare infrastructure, which is often leveraged to obscure the true origin of malicious sites. The site appeared on 3 security blocklists, and its trust score was rated 0/100 by Gridinsoft. Additional technical indicators include the use of Prebid, Google Publisher Tag, Google Analytics, Funding Choices, cdnjs, AppNexus, and HTTP/3, which may have been employed to mimic legitimate site behavior and evade detection. The domain has since been taken offline, but users who may have interacted with it are at risk of device compromise or data theft. It is recommended to verify the authenticity of any software download sources, particularly those offering premium features for free. Users should scan their devices for malware if they downloaded the APK from this domain. Network administrators are advised to block the domain and its associated IP (188.114.97.3) at the firewall or DNS level to prevent future access. Additionally, monitoring for unusual outbound connections to similar domains or IPs is strongly encouraged.