A US government crackdown on a cybercriminal proxy network inadvertently broke the core Telegram shortlinks domain t.me worldwide, rendering millions of group, profile, and channel links inaccessible for about a day.
- Sanctions targeted First VPN for cybercriminal activity
- Domain registry applied full hold on Telegram's t.me domain
- Telegram links restored after removing VPN channel
What happened
The US Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), a known cybercriminal proxy network, aiming to disrupt ransomware operators and related criminal infrastructure. As part of this action, the treasury published a list of web addresses linked to 1VPNS, including a Telegram support channel located under the t.me domain.
Because top-level domains and registries must comply with sanctions swiftly, the Montenegro-based registry managing the .me domain placed a 'serverHold' status on the entire t.me domain. This action removed t.me links from the global Domain Name System (DNS), causing all Telegram shortlinks using t.me, such as group invites and profiles, to stop working worldwide, affecting roughly one billion users.
Why it matters
The incident highlights the fragility of internet infrastructure where a single sanction-related domain action can unintentionally disrupt a critical communication platform for a massive global user base. Telegram’s shortlink system is integral to how users share and access groups, channels, and profiles, making this outage particularly impactful.
This scenario underscores challenges in how sanctions are enforced on digital infrastructure tied to complex online services. Registry operators lack the technical ability to isolate individual URLs or channels, resulting in potentially broad collateral damage to unrelated services and users when a domain or subdomain is sanctioned.
What to watch next
Telegram’s leadership promptly engaged with the domain registrar once the cause was identified. Telegram removed the sanctioned First VPN-related channel from its platform, which allowed the registry to lift the hold and restore normal function to t.me links in about 24 hours.
Going forward, this event may prompt increased scrutiny of domain registry compliance processes and potential technical improvements to allow more granular sanctions enforcement without jeopardizing entire domains, especially those critical to global communication platforms like Telegram.