How Telegram’s New Link Format Can Expose Your Location to Law Enforcement

On August 29, Telegram founder and CEO Pavel Durov announced on his Telegram channel that the messenger has started supporting a new type of link. Now, a username written in Latin characters can appear before the page address, not just after it. According to Durov, in addition to the familiar links like t.me/username, new links like username.t.me will be available. This change comes ahead of the launch of a platform within Telegram for selling memorable usernames through auctions.

“In anticipation of upcoming events, today we are adding support for links like username.t.me for every Telegram username, in addition to the existing t.me/username. These links are already working in any browser,” said Pavel Durov.

Why Did Telegram Make This Change?

It’s quite interesting why the Telegram team decided to take this step. Most of us have, out of curiosity, checked or shared our username or channel link on t.me at least once. This is a standard interactive redirect to the main Telegram app page.

Previously, when you visited such a link, no one could guess which username you were accessing—the link was hidden inside TLS 1.2 traffic. Everything was anonymous, and many users shared their links on doxxing portals, opposition forums, application forms, and so on.

Now, however, when you visit vova.t.me, your username vova appears in the TLS Server_Name_Indication extension.

What Does This Mean for Your Privacy?

Let’s look at this in WireShark:

• If you have ever visited your own link without a VPN, you have officially exposed your IP address to law enforcement agencies.
• According to the Yarovaya Law, telecom operators are required to store internet traffic for 30 days. But even after 30 days, the situation doesn’t improve, as the government highly values such sensitive information.

What Should You Do?

Simply never use these types of standard links anywhere, and don’t click on unfamiliar ones.