kms-full[.]com

The domain kms-full.com was registered on 21 February 2026 and resolves to the IPv4 address 94.156.177.53, which is geolocated to the Netherlands and associated with the individual Baykov Ilya Sergeevich. The domain is presently taken offline and appears on two security blocklists; it is also blocked by the commercial mitigation services PhishDestroy and CryptoFirewall. Authoritative name servers for the zone are 2-nest.pipe.ma, 1-ceci.njalla.do, and 3-pas.njalla.in, indicating the use of the Njalla privacy‑focused registrar.

VirusTotal analysis shows that 17 of 93 scanned security vendors flagged the domain as malicious, reflecting a moderate consensus of suspicious activity. AlienVault OTX has incorporated the indicator into 19 threat‑intelligence pulses, further corroborating its classification as a generic phishing campaign. Publicly available scans have not disclosed the TLS certificate status, HTTP response codes, or the page title presented by the site, and Safe Browsing records are not referenced in the supplied data.

Defenders should continue to block both the domain and the underlying IP address at perimeter defenses, add the three name servers to watch lists, and ensure that any inbound or outbound traffic to 94.156.177.53 is denied. Ongoing correlation with the 19 OTX pulses can help surface related activity, and the presence on multiple blocklists suggests that inclusion in internal blacklists will reduce exposure. Continuous re‑scanning with VirusTotal or comparable services is recommended to capture any changes should the domain be re‑activated.