Deutsche TelekomDeutsche Telekom
Private report / LOLIPOP hosting

Remove the copied login.

The counterfeit T-Online page was served from a LOLIPOP account on ciao.jp. Outtake can request account review and suspension, then verify whether the page is still online.

Recon / Deutsche TelekomSep 8, 2026

Provider target

LOLIPOP hosting

Copied login page

Requested action

Request account review

Recommended in a dated report. Current status and provider outcome need verification.

Provider report / LOLIPOP hosting

What this report asks the provider to do.

The September 8 investigation supports a provider-specific request. Outtake can file it on Deutsche Telekom's behalf and follow the response.

What the report confirmed

The September 8 report linked one counterfeit T-Online login at minoh[.]ciao[.]jp to a LOLIPOP account on ciao.jp. It did not establish other pages on that account.

Evidence for the provider

Page captures on desktop and mobile, copied brand elements, the hosting link, page source, and the cited malicious scan results.

What Outtake can do

Outtake can ask the hosting provider to review and suspend the account, follow the provider response, and check whether the page is still accessible.

What changes, and what does not

A suspension would remove this page's delivery from that host. It would not necessarily disable the separate Telegram bot or prevent a new copy elsewhere.

Proof of outcome

Recheck the URL and look for a replacement deployment before calling the page removed.

Deutsche TelekomDeutsche Telekom

Private cybersecurity briefing / provider reports

September 8, 2026 T-Online impersonation investigation. Historical findings, not a live status check.