Solved: A Ransomware Sanction Accidentally Took Down Telegram’s Domain

Almost twelve hours after t.me links stopped working everywhere, we finally know why — and it has nothing to do with a hack, a takedown order against Telegram, or anything the company did wrong. The culprit was a single line in a US Treasury sanctions filing that appears to have taken out an entire domain used by billions.

On July 13, the Treasury’s Office of Foreign Assets Control (OFAC, the agency that maintains America’s sanctions lists) designated ransomware-linked VPN service 1VPNS, its administrator, and a malware “cryptor” seller for supporting attacks on US hospitals, banks, and municipalities. Buried in that sanctions filing was one identifying detail: 1VPNS’s own Telegram group, listed by its shortened web address, t.me/FirstVPNService. We checked the entry directly on OFAC’s sanctions search tool and confirmed the link is right there in the record.

OFAC sanction

About four hours after that filing went public, WHOIS records show the .me registry slapped Telegram’s entire t.me domain with a “serverHold” — a status that strips a domain from global DNS (the internet’s address book) so it stops resolving anywhere, for anyone. Not just the one flagged channel; every t.me link on Earth.

That’s the technical crux of it: sanctions-compliance tooling typically works at the domain level, not the individual URL. There’s no clean way to block a single t.me/FirstVPNService page without touching t.me itself, since Telegram’s short links all share a single root domain. Telegram’s app kept working throughout, since the hold only affected the domain, not Telegram’s servers.

The bigger lesson here is about fragility. Any platform that funnels its entire public-facing link system through one shared domain is one compliance action away from a global outage, regardless of how many users are actually involved in whatever triggered it.

The good news: t.me is back and resolving normally as of this morning, so no action is needed on your end. If you maintain sites or bios with t.me links, you can safely restore them — just keep telegram.me bookmarked as a backup in case this happens again.