getkmspico[.]com

Analysis of getkmspico.com confirms it as an active phishing infrastructure impersonating Microsoft to distribute unauthorized activation tools. The domain, registered on April 14, 2016, through GANDI SAS, resolves to IP address 144.172.107.79 and is hosted on an Nginx server with Bootstrap, jQuery, Google Hosted Libraries, Google Analytics, and ShareThis technologies detected. The page title explicitly claims to be 'The Official KMSpico Site | Download KMSpico 10.2.0,' directly targeting users seeking Microsoft software activation bypass tools. The domain is flagged by 13 of 95 security vendors in available scans and appears on seven security blocklists, including PhishDestroy, ScamBlocklist, PhishingDB, AdGuard, and OISD. AlienVault OTX records the domain in 50 threat intelligence pulses, indicating sustained malicious activity. The SSL certificate is issued by Let's Encrypt, a common practice among phishing sites to appear legitimate. The domain's trust score is 1 out of 100, further supporting its classification as high-risk. While the exact content of the site has not been manually verified, the combination of brand impersonation, low trust scores, blocklist presence, and detection by multiple security vendors confirms its malicious intent. Defenders should treat this domain as active phishing infrastructure and block it at the network and endpoint levels. No legitimate Microsoft activation tool would be distributed through this domain, and users should be warned against downloading any software from it.