Internet-Security raven logo internet-security.com

TCP 1688

ProtocolTCP
Port1688
LabelsMicrosoft Key Management Service (KMS) for Windows Activation

Synopsis

  • TCP port 1688 is the default port used by Microsoft Key Management Service (KMS) for Volume Activation.
  • Windows client and server editions (e.g., Windows 10/11 Enterprise/Education and Windows Server 2012 and later) contact a KMS host on 1688 to activate.
  • Microsoft Office volume‑licensed products (Office 2016/2019/2021 and Office LTSC) also activate via KMS on 1688.
  • Cloud platforms expose KMS endpoints on this port: Azure uses kms.core.windows.net:1688, Google Cloud uses kms.windows.googlecloud.com:1688, and AWS Windows instances use the link‑local 169.254.169.250:1688 endpoint.
  • The KMS host is typically a Windows Server running the Software Protection Service (sppsvc) listening on TCP 1688.
  • Security note: Port 1688 is often abused by illicit KMS emulators (e.g., KMSPico, vlmcsd) to bypass activation and is frequently associated with malware distribution.

Observed activity

Last 30 days Detailed chart

More information