crystaldiskmark[.]io

This domain, crystaldiskmark.io, is flagged as a credential phishing site impersonating the legitimate disk benchmark software CrystalDiskMark. The domain remains active and is designed to harvest user credentials or distribute malicious payloads under the guise of a trusted utility. Analysis indicates the infrastructure is specifically crafted to exploit the reputation of the legitimate CrystalDiskMark brand, which is widely used for storage performance testing. Infrastructure analysis reveals the domain was registered on March 06, 2026, through Spaceship, Inc. It resolves to the IP address 188.114.96.3 and is currently blocked by one security blocklist, Maltrail. The SSL certificate is issued by Let's Encrypt, a common practice among phishing operators to lend false legitimacy. VirusTotal reports zero detections out of 95 vendors at the time of analysis, suggesting the campaign may still be in an early or evasive phase. The page title, "CrystalDiskMark – Free Disk Benchmark Software | CrystalDiskMark.io," closely mimics the legitimate site to deceive users. Current status indicates the domain remains active and poses an ongoing risk to users seeking disk benchmarking tools. Organizations and individuals are advised to block the domain at the network level and add the IP address 188.114.96.3 to firewall deny lists. Security teams should monitor for connections to this infrastructure, particularly in environments where CrystalDiskMark is commonly used. Users should be educated to verify domain authenticity before downloading software, and endpoint protection solutions should be updated to detect potential payloads associated with this campaign.