Deutsche TelekomDeutsche TelekomThe T-Online clone was only the entry point.
Outtake's Recon investigation traced a counterfeit Deutsche Telekom/T-Online login to its hosting account and Telegram credential receiver. See how autonomous agents can use that evidence for takedowns in separate provider cases, follow up with each provider, and verify the outcomes instead of stopping at the URL.
Observed entry point
Counterfeit T-Online login
One confirmed page
Delivery
LOLIPOP hosting
Provider case: copied page
Collection
Telegram bot
Provider case: credential receiver
02 / Beyond the URL
To disrupt a campaign, find what keeps it running.
Outtake's agents link a visible scam to its delivery, collection, and operator infrastructure. Shared dependencies can become stronger enforcement targets than individual URLs. In this investigation, the confirmed scope is one page and its Telegram exfiltration chain, not a proven network of related phishing sites.
Investigation map / Sep 8, 2026
One operation. More than one place to act.
What the report traced
The copied login depended on a hosting account to appear and a bot to deliver stolen credentials. Those are separate points for provider review.
ENTRY POINT
Counterfeit T-Online login
minoh[.]ciao[.]jp
RECEIPT
Operator group
Two members in the report
Select the host or bot to inspect its response path.
Selected dependency / LOLIPOP hosting account
- Evidence
- Captured page, copied Telekom branding, and hosting linkage
- Provider request
- Ask the provider to review and suspend the account serving the counterfeit login
- Verification
- Revisit the page and confirm whether it remains available
Only the relationships documented in the September 8 report are shown. No wider campaign is claimed.
Build separate cases against the host and the credential receiver.
Outtake's agents can prepare separate evidence packages for LOLIPOP and Telegram, carry the provider follow-up, and check the outcome of each case. Where multiple sites truly share an infrastructure dependency, action at that dependency can disrupt more than one page. This report does not prove such a wider cluster here.
The evidence points to two separate dependencies.
Outtake's Recon report documented a counterfeit T-Online login on Japanese free hosting. Its page source sent submitted credentials to a Telegram bot before redirecting visitors to the legitimate site. One provider serves the page; another controls the receiver. Each needs its own evidence, request, and outcome check.
A counterfeit page. A hardcoded Telegram bot. A two-member receiving group.
The report identified one confirmed phishing page, five malicious nodes, and 24 evidence artifacts. It did not establish the number of affected customers or link other deployments to this operator.
Review the dated findingsSource: Outtake Recon threat report, September 8, 2026. Report status is historical, not a live check.
04 / How Outtake works
Detect the signal. Dismantle the dependencies.
Autonomous agents handle the search, investigation, correlation, and provider follow-through in one workflow. Your team sets the enforcement preferences and sees the evidence; the agents carry the repetitive work instead of handing you another alert queue.
Detect
Find the impersonation
Discovery agents search external surfaces for copied brands, domains, profiles, and scam journeys. In this case, the seed was a counterfeit T-Online login.
Investigate
Trace what connects it
Investigation agents capture the page and inspect source, network behavior, and infrastructure. The report traced this page to a hardcoded Telegram bot and receiving group.
Correlate
Separate links from lookalikes
Correlation agents group assets only when evidence supports a shared dependency. The common phishing kit in this report did not establish a wider operator campaign.
Dismantle
Act where it matters
Remediation agents can prepare the hosting and bot cases, manage provider follow-up, and check what changes. Wider shared infrastructure becomes a priority when it is actually confirmed.
Less lift for your team
You set the guardrails. Agents carry the case.
Deutsche Telekom can decide what should be reviewed and when to escalate. Outtake's agents assemble provider-ready evidence, coordinate reporting and follow-up, then recheck the page and bot so your team can focus on decisions rather than case administration.
For this September 8 case, these are proposed actions, not completed takedowns. Each provider controls its own enforcement decision.
05 / Recon findings
One copied login. Two provider cases. Separate proof of removal.
See the evidence for each provider report, what the requested action could disrupt, and the checks required before Outtake marks it complete.
06 / Evidence collected by Outtake
Evidence Outtake can package for provider action.
07 / Provider reports
Two reports. One takedown workflow.
See the evidence Outtake can send to each provider, the requested action, and how removal would be checked.
Stop credential collection
Outtake can file a bot abuse report with the captured exfiltration evidence, follow up, and verify the provider's decision.
Open Telegram reportRemove the copied login
Outtake can request account review with the copied-page and hosting evidence, then check whether the page is removed.
Open hosting reportSource: Outtake Recon threat report, September 8, 2026. These are recommended provider actions, not completed takedowns.
08 / The response in focus
The job ends when the outcome is checked, not when the report is sent.
For this T-Online case, Outtake can prepare distinct hosting and Telegram cases, follow the providers' decisions, and verify the page and bot separately. Deutsche Telekom sets the review boundaries while agents do the evidence and case work. The September 8 report recommends these actions; it does not record completed removals.