capcut[.]net[.]pk

Analysis indicates that capcut.net.pk is an active malicious site registered on 11 March 2026. The domain is served through Cloudflare (AS13335) and resolves to 104.21.52.184, using Cloudflare’s kobe.ns.cloudflare.com and sreeni.ns.cloudflare.com name servers. TLS is provided by Google Trust Services / WE1, and the site returns HTTP 200 with the page title “CAPCUT – Download CapCut Apk v14.0.0 Without Watermark 2025 – CapCut”. Although the title references the CapCut brand, the listed brand target is “across”, and the intelligence classifies the operation as a crypto‑scam. The domain appears on three public blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL. An AlienVault OTX pulse references the domain, and one of ninety‑four VirusTotal scanners flagged it as malicious. MX records point to Cloudflare mail routing (priority 8 and 43). No further content analysis is available, so the exact lure or payload cannot be confirmed. Defenders should immediately block DNS resolution for capcut.net.pk, add the IP address 104.21.52.184 to network‑level deny lists, and ensure that web‑filtering solutions ingest the listed blocklist entries. Continuous monitoring of newly registered domains using the same name‑server pair is advised, as the infrastructure suggests a repeatable abuse pattern. Organizations should also alert users that any unsolicited links promising CapCut APK downloads without watermark may be part of this campaign.