# kmspico-official.org — MALICIOUS

> KMSpico-official.org is flagged for phishing risks. Avoid this domain to protect your data and devices from potential threats.

## Summary
PhishDestroy identifies kmspico-official.org as a high-risk phishing domain impersonating legitimate KMS activator tools, aiming to deceive users into downloading malicious software. Such threats can lead to credential theft, malware infection, or system compromise.

The domain, created on March 11, 2026, resolves to IP 104.21.14.199 and is registered via Dynadot LLC. It remains active and is listed on three security blocklists, with 16 out of 95 VirusTotal security vendors flagging it as suspicious.

Users are advised to avoid interacting with kmspico-official.org or downloading any content from it. Always verify software sources and use trusted activation tools to safeguard personal and system security.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 200)
- Page title: KMSpico Download | Official Website KMS Activator【December 2024】

## Domain Intelligence
- Registered: 2026-03-11 17:07:02
- Registrar: Dynadot LLC
- Country: US
- IP: 104.21.14.199
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["koa.ns.cloudflare.com", "millie.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 16 vendors flagged
  Vendors: ["ADMINUSLabs", "alphaMountain.ai", "BitDefender", "CyRadar", "Dr.Web", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Lionic", "Seclookup", "SOCRadar", "Sophos", "Sucuri SiteCheck", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce649-5fa5-722d-a1af-511e54af8c6b.png
- PhishDestroy: https://phishdestroy.io/domain/kmspico-official.org/
- LLM endpoint: https://phishdestroy.io/domain/kmspico-official.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kmspico-official.org/
Last updated: 2026-03-19