kms-pico[.]ws

The domain kms-pico.ws is currently active and classified as a high‑risk brand‑impersonation campaign targeting LinkedIn. The site’s page title, “KMSPico 2026 Download | For Windows 11, 10, 8 & Office,” indicates an attempt to lure victims with a purported software downloader, while the listed brand target confirms LinkedIn impersonation. The campaign’s seed identifier d9bd8f is associated with a unique threat profile.

Infrastructure analysis shows the domain resolves to the IPv6 address 2400:52e0:1e00:2::1332:1, which maps to an autonomous system owned by Datacamp Limited (AS60068) and is geolocated in Germany. The domain was registered on 11 March 2026 and uses Azure DNS name servers (ns1‑04.azure‑dns.com, ns2‑04.azure‑dns.net, ns3‑04.azure‑dns.org, ns4‑04.azure‑dns.com). Mail exchange is handled by mx.stackmail.com (priority 10). TLS is provided by a Sectigo Limited certificate issued by the Sectigo Public Server Authentication CA DV R36, indicating a valid‑looking HTTPS configuration.

Reputation signals are strongly negative. The Gridinsoft trust score is 0 / 100, and the domain appears on three public security blocklists. It has been referenced in 22 AlienVault OTX threat‑intelligence pulses, and one of ninety‑five VirusTotal scanners flagged the domain. The site returns an HTTP 301 redirect, and it is currently blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification.

While the observable infrastructure confirms a deliberately crafted impersonation effort, the content of the landing page has not been directly analyzed, leaving the exact user‑experience unknown. Defenders should prioritize blocking the domain at network perimeter filters and DNS resolvers, monitor for any related indicators of compromise, and educate users about unexpected LinkedIn‑related download offers. Ongoing telemetry collection is recommended to capture any evolution of the payload or additional infrastructure.