A US sanctions action targeting a cybercrime-linked VPN service briefly disrupted Telegram’s ‘t.me’ shortlinks, affecting group invites, channel access, and profile sharing for millions of users.
Telegram users worldwide experienced widespread disruption after all ‘t.me’ shortlinks suddenly stopped working, preventing access to group invitations, public channels, and user profiles across the messaging platform.
The outage was not caused by a technical malfunction within Telegram. Instead, it stemmed from an unintended consequence of a United States sanctions action targeting infrastructure linked to an alleged cybercriminal proxy network.
On July 13, the US Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against the operators of First VPN Service (1VPNS), accusing the service of supporting infrastructure used by ransomware groups.As part of the sanctions announcement, authorities published a list of associated online resources, including a public Telegram support channel that used the t.me domain.
The inclusion of the Telegram link ultimately triggered a broader domain suspension.
According to domain operator Domain.Me, which manages Montenegro’s .me country-code top-level domain, the t.me domain was temporarily placed under serverHold status after receiving a compliance request related to the sanctions.Because domain registries cannot disable only a single URL path within a domain, the action affected the entire t.me namespace, making Telegram shortlinks inaccessible across the internet.
Although Telegram’s messaging service remained fully operational, users could not open public channel links, invitation URLs, or shared profile links that relied on the t.me domain. Telegram founder and CEO Pavel Durov initially requested that the registrar investigate the unexpected suspension after users reported widespread access problems.
Once the cause was identified, Telegram removed the sanctioned channel referenced in the sanctions documentation.
Following those changes, Domain.Me lifted the suspension and restored normal operation of the t.me domain.
The registry operator confirmed that the domain was reactivated after Telegram addressed the issue. The incident has drawn attention to the interconnected nature of global internet infrastructure and how regulatory actions can sometimes produce unintended consequences.
Cybersecurity experts note that while sanctions are intended to disrupt malicious actors, the case demonstrates how actions affecting shared internet resources can inadvertently impact millions of legitimate users.
The disruption also highlights the importance of careful coordination between governments, domain registries, and online platforms when implementing cybersecurity enforcement measures.
