One‑Click Telegram Proxy Link Can Reveal Your Real IP Address

Security researchers recently disclosed a high‑risk privacy leak in Telegram's proxy links. When a user clicks a specially crafted internal link, the Telegram client on Android or iOS automatically attempts to connect to the proxy server, without any confirmation dialog, thereby exposing the user's real IP address.

How the attack works

The attacker creates a link that looks like an ordinary Telegram username (e.g., @durov) but actually points to a proxy URL such as:

https://t.me/proxy?server=[server IP or hostname]&port=[proxy port]&secret=[MTProto key]

When the target opens this link, the client reads the proxy parameters (server, port, secret) and immediately sends a network request to the attacker‑controlled server before the user can react. The attacker’s server logs the real IP address. The researchers compared this to the Windows NTLM hash leak, where a single interaction triggers an automatic outbound request.

Attack demonstration steps

Set up an MTProto proxy server under the attacker’s control.

Create a disguised proxy link, for example:

https://t.me/proxy?server=1.1.1.1&port=53&secret=SubscribeToGangExposed_int

Send the link to the victim in the form of a username like "@durov".

When the victim clicks the username in the Android or iOS Telegram client, the client automatically tests the connection, bypassing any other configured proxies, and sends the real IP address directly to the attacker’s server. The whole process is silent; the user only sees a normal username click.

Telegram’s response

"Any website or proxy operator can see a visitor’s IP address; this is not unique to Telegram and is the same for services like WhatsApp."

Telegram acknowledged the point but emphasized that the deceptive automatic connection is the core problem. The company has promised to display a warning when a proxy link is clicked, though no timeline has been provided.

Risks

Location inference: attackers can approximate the user’s geographic region from the IP.

Targeted attacks: combined with other information, attackers can launch DoS or other targeted assaults.

De‑anonymization: users who rely on proxies to hide their identity lose that protection.

For users in restrictive network environments who depend on proxies for safety, this "one‑click exposure" is especially dangerous.

Mitigation

The only practical mitigation today is to remain vigilant about links that appear to be usernames, especially those that redirect to the t.me domain. If a link’s destination is uncertain, avoid clicking it until Telegram’s warning is deployed.

Source: BleepingComputer, https://www.bleepingcomputer.com/news/security/hidden-telegram-proxy-links-can-reveal-your-ip-address-in-one-click/