Loading story…
Telegram’s t.me domain was placed on serverHold at the .me registry, removing it from global DNS resolution and breaking t.me short links worldwide. Reports said the disruption affected invite links, channel previews, and shared message URLs, while WHOIS records showed additional status flags including clientDeleteProhibited and serverDeleteProhibited. The domain registration remained active through 2035, indicating the outage was not caused by expiration.
The action appeared to originate at the registry level rather than through Telegram’s registrar account, with WHOIS data showing an update timestamp of 2026-07-13T19:24:55Z. No public explanation had been issued by Telegram, the .me registry, or Identity Digital at the time of reporting. Telegram’s core messaging service appeared to remain largely operational through its primary domains and IP-based connections, limiting the impact mainly to the platform’s link-sharing and discovery functions.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
After t.me was placed on serverHold, the domain was removed from global DNS resolution, breaking Telegram short links, invite links, channel previews, and shared message URLs worldwide. Reporting said Telegram's core messaging service appeared to remain largely operational through primary domains and IP-based connections.
DomainME said it had placed Telegram's t.me domain on hold for OFAC compliance and later restored it, bringing the shortlink domain back online after roughly a day of disruption. The report says telegram.me remained operational during the incident.
WHOIS data showed Telegram's t.me domain carrying serverHold along with clientDeleteProhibited and serverDeleteProhibited, with an update timestamp of 2026-07-13T19:24:55Z. The registration remained active through 2035, indicating the change was not caused by expiration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberaccord.com
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Texas Attorney General Ken Paxton announced a court-backed action to lock the `.com` domain of a Dutch pornography website for failing to comply with Texas rules, framing the move as a measure to protect minors from harmful content. The case drew attention because it targeted a globally reachable domain at the registrar or registry layer rather than only blocking access locally, highlighting how legal action in one jurisdiction can disrupt online services across borders. The suspension became a focal point in NANOG discussions after participants linked it to another recent registrar-level takedown involving Telegram’s shortlink domain, which was reportedly suspended for about a day. Operators debated whether such incidents represent a new DNS vulnerability or a policy issue, but several participants agreed they pose a real operational risk for DNS-dependent organizations and warrant contingency planning for sudden domain loss, registrar action, and broader neutrality concerns around control of major top-level domains.
Jul 26, 2026
A widespread outage hit **Meta** services, disrupting Facebook, Instagram, Messenger, and WhatsApp for users across North America, Europe, Asia, and the Middle East. Users reported being logged out, unable to sign back in, seeing blank screens, failing to refresh feeds, and experiencing delayed messages or desktop-site errors across Android, iOS, and web platforms. Downdetector recorded a sharp spike in complaints, including more than **80,000** reports tied to Facebook shortly after the disruption began. The incident also affected business operations, with advertisers, publishers, and content creators reporting problems with **Facebook Ads Manager** and related tools. Meta had not publicly identified the cause at the time of reporting, though the breadth of the disruption pointed to a likely backend or shared infrastructure failure rather than a client-side issue. No evidence indicated a cybersecurity incident, but reports warned that scammers could exploit the outage with fake recovery messages and phishing lures.
Jun 29, 2026