The Anonymity Trap: New Telegram Flaw Leaks Real IPs via Proxy Links

The Anonymity Trap: New Telegram Flaw Leaks Real IPs via Proxy Links reports that a vulnerability in Telegram could exfiltrate authentic IP addresses through malicious proxy-related hyperlinks. The issue stems from how the client handles proxy-server URLs: when a user taps a proxy link, Telegram attempts to verify the proxy’s reachability, which creates a direct connection to the proxy’s host and reveals the user’s real IP address to the server administrator.

The flaw can be concealed by disguising the link as a username mention or a reputable website URL, with targets such as t[.]me/proxy?server=... embedded in the link. The vulnerability affects Telegram clients on both Android and iOS, posing a risk for users who depend on the service for sensitive discussions.

Telegram has promised to introduce a warning that will show when clicking proxy links to alert users to disguised links, and, in an official communique, emphasised that this phenomenon is not unique to Telegram. According to International Cyber Digest, the platform’s response includes a cautionary prompt rather than a denial of the wider risk. 15 January 2026.