kms-full[.]io

This domain, kms-full.io, is actively hosting a confirmed scam site impersonating KMSPico activation tools for Windows and Office. Registered on August 25, 2025, through NiceNIC International Group Co., Limited, the domain resolves to 185.208.156.66 (AS42624, Global-Data System IT Corporation, Switzerland) and uses nameservers ns1.safe-networks.net and ns2.safe-networks.net. The site returns an HTTP 301 redirect, though the destination remains unconfirmed. The page title explicitly advertises 'KMS Full - KMSPico Activator for Windows & Office,' aligning with the reported scam type targeting users seeking unauthorized software activation. Analysis indicates the domain is flagged by three security blocklists and holds a trust score of 0/100. Eleven of 95 security vendors on VirusTotal detect the domain as malicious. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious infrastructure. While the exact payload or delivery mechanism is not yet analyzed, the domain’s association with KMSPico—historically linked to malware distribution—suggests a high likelihood of malicious intent. Defenders should treat this domain as active, high-risk infrastructure. Blocking resolution at the DNS or network level is recommended, along with monitoring for connections to the associated IP (185.208.156.66) or nameservers. Given the domain’s age and persistent activity, it may serve as part of a broader campaign. Further investigation into the redirect target and any hosted payloads is advised to determine the full scope of the threat.