Deutsche TelekomDeutsche TelekomOuttake's September 8 report identifies two separate enforcement targets: the Telegram bot receiving credentials and the LOLIPOP account serving the copied login. The page shows what each report needs, what removal would change, and what must be rechecked first.
Status and confidence are from the dated report, not a fresh live check.
01 / Provider action plan
The September 8 report recommends both actions and says Outtake can file on Telekom's behalf. It does not document completed takedowns. Provider decisions and timing are outside Outtake's control.
TELEGRAM BOT
Credential receiver
Evidence to send
Hardcoded bot endpoint in page source and captured exfiltration trace.
Request and verification
Outtake can file a Telegram abuse report to disable the bot and follow up on the decision.
If disabled, the observed page loses its documented credential receiver. Check the bot and collection path after the provider responds.
LOLIPOP ACCOUNT
Page delivery
Evidence to send
Copied T-Online page, host linkage, screenshots, and malicious scan verdicts.
Request and verification
Outtake can request a LOLIPOP account review and suspension and follow up on the decision.
If suspended, this hosted page should become unavailable. Recheck the URL and watch for a replacement on another host.
Separate customer response
Deutsche Telekom can assess affected-account evidence before any targeted notice or password-reset guidance. The report does not establish who entered credentials, so this is a precaution, not a third provider takedown.
Open investigation leads
The report proposes checking an August GitHub Pages deployment and two Vercel deployments for bot-token matches, plus tracing reuse of the operator's handle. Those links were not confirmed in the report and are not included in the proven campaign scope.
02 / Evidence behind each request
The report identifies five malicious graph nodes and one unknown IP. The 6,897+ kit instances cited worldwide are not linked to this operator.
The page at minoh[.]ciao[.]jp copied the T-Online login appearance. The investigation dated September 8 records it as active; its status since then has not been rechecked for this briefing.
Preserve current evidence and confirm status before filing.
Hardcoded JavaScript sent submitted usernames and passwords to a Telegram bot, which delivered them to a two-member operator group. The page then redirected to the legitimate site.
Prepare a Telegram abuse report with the captured script and network trace.
The report identifies the LOLIPOP account serving the phishing page as a separate delivery dependency. It does not prove other campaigns share this account.
Request provider account review with the captured page evidence.
No number of affected customers or wider coordinated campaign was established.
03 / Investigation replay
01 / observed
minoh[.]ciao[.]jp / observed malicious
02 / observed
Credential receiver / observed malicious
03 / observed
Two members / reported collection point
Related GitHub Pages and Vercel deployments are investigation leads, not proven links to this bot.