capcutapkdown[.]com

The domain capcutapkdown.com is identified as a credential theft site impersonating the CapCut video editor brand. Analysis confirms it is currently offline, but prior activity involved distributing fraudulent APK files under the guise of a "CapCut Pro" update. The site targeted users seeking unauthorized or modified versions of the legitimate CapCut application, likely harvesting login credentials or installing malicious payloads. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Spaceship, Inc., and resolved to the IP address 172.67.132.244. It was flagged by 9 of 95 security vendors on VirusTotal, received a trust score of 0/100 from Gridinsoft, and appeared on three security blocklists. Detected technologies include Cloudflare, reCAPTCHA, and Hostinger, while the SSL certificate was issued by Google Trust Services. The domain was blocked by MetaMask, SEAL, and PhishDestroy, further corroborating its malicious classification. Although capcutapkdown.com is currently offline, users who may have interacted with the site should assume credential compromise. Immediate actions include resetting passwords for any accounts accessed on or after the site’s active period, scanning devices for malware, and verifying the authenticity of installed applications. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Vigilance is advised when downloading software from unofficial sources, particularly those offering modified or "pro" versions of legitimate applications.