picoreteam[.]online

The domain picoreteam.online is a generic phishing site designed to facilitate account takeover scams, specifically targeting users of the Pi Network cryptocurrency platform. It does not impersonate a well-known consumer brand or employ a known drainer kit. As of the latest verification, picoreteam.online has been taken offline, though it previously posed an elevated risk to visitors seeking to unlock or manage Pi coins.

Technical analysis reveals that picoreteam.online was flagged by 2 of 95 security vendors on VirusTotal, including Bfore.Ai PreCrime and Gridinsoft. The domain appears on 1 security blocklist, specifically PhishDestroy. It was created on February 21, 2026, and resolved to the IP address 18.196.241.217, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The SSL certificate was issued by E5, and the observed page title read 'Unlock Locked Pi Coins, Fast and Easy. Community & Developer Platform | Pi Network'. Detected technologies include Nginx and OpenResty.

Users who interacted with picoreteam.online should immediately change their Pi Network account passwords and enable two-factor authentication if not already active. Monitor account activity for unauthorized transactions or changes. If cryptocurrency wallet credentials were entered, consider transferring funds to a new wallet and revoking any token approvals granted during the interaction. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.