crystaldiskmark[.]cc

This domain, crystaldiskmark.cc, is flagged as a generic phishing site targeting users seeking CrystalDiskMark, a legitimate disk benchmarking utility for Windows. Analysis indicates the domain mimics the official CrystalDiskMark branding, presenting a page titled 'CrystalDiskMark – Free Disk Benchmark for Windows | SSD, HDD, NVMe.' The site does not appear to deploy a crypto drainer or fake login portal but instead likely distributes malicious executables disguised as legitimate software installers. No specific drainer kit signatures have been identified at this stage, though the domain structure and content align with common brand impersonation tactics. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.171.23 and was registered on March 06, 2026, through Spaceship, Inc. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites. VirusTotal reports 0 detections out of 95 engines, indicating no current antivirus signatures flagging the domain as malicious. However, the domain appears on one security blocklist, as recorded by Maltrail, suggesting preliminary detection by at least one threat intelligence source. Google Safe Browsing (GSB) status remains unconfirmed in the provided data. The domain remains active, with no takedown or sinkholing observed as of this report. Users are advised to avoid downloading software from this domain and to verify the authenticity of CrystalDiskMark downloads by sourcing them exclusively from the official vendor website or trusted repositories. Given the domain's recent registration date (anomalous for a project like CrystalDiskMark, which has been established for over a decade) and the presence on a security blocklist, the risk of malware distribution persists. Organizations should consider blocking the domain at the network level and monitoring for connections to the associated IP address 172.67.171.23.