What the t.me Domain Outage Reveals About the Reach of OFAC Sanctions
On July 13, 2026, at 7:24:55 p.m. UTC, Telegram’s short-link domain — t.me — stopped resolving worldwide. Every link in that format (t.me/username, t.me/channelname, group invites, bot links, TON wallet references) went dark for roughly 19 hours. Telegram’s core app kept working; only the shortlink layer was affected, and the company temporarily rerouted new links through its backup domain, telegram.me.
WHOIS and RDAP records showed eight EPP status flags applied simultaneously, including serverHold, clientDeleteProhibited, and serverDeleteProhibited — flags a domain registry, not Telegram or its registrar GoDaddy, controls. Telegram founder Pavel Durov posted publicly asking the .me registry to look into the outage, without any advance notice of what had caused it.
The Sanctions Connection
The cause traces back to a July 13 OFAC action. That day, Treasury’s Office of Foreign Assets Control added First VPN Service (1VPNS) — a Ukraine-based VPN provider — to the SDN List, citing its use by ransomware operators including groups tied to Anubis, Qilin, and Sinobi Group, per blockchain analysis firm TRM Labs. An FBI notice had separately linked the service to at least 25 ransomware groups. The SDN entry listed several contact identifiers for 1VPNS, including a Telegram channel: t.me/FirstVPNService.
t.me itself was never sanctioned. But the registry operating the .me top-level domain — Identity Digital, working with Montenegro-based registrar DomainME — had no mechanism to isolate a single channel path within someone else’s domain. Rather than resolving the specific address named in the SDN filing, the registry placed a hold on the entire domain. DomainME later confirmed publicly that the suspension was applied “due to OFAC compliance,” though no agency has issued a detailed account of exactly how the decision was made.
The hold was lifted on July 14, after roughly 19 hours, once the registry restored the domain to normal status.
Why This Matters Beyond Telegram
This appears to be the first publicly documented case of a sanctions designation naming a single messaging-platform address triggering a registry-level suspension that disrupted access for an entire global user base — by some estimates, close to a billion people simultaneously — none of whom had any connection to the sanctioned entity.
The structural issue isn’t the underlying sanctions decision against 1VPNS, which multiple sources tie to real ransomware activity. It’s the blunt-instrument nature of enforcement at the domain-registry level: when an SDN filing lists a URL that happens to sit on a third party’s shared domain, that registry — often operating under U.S. jurisdictional exposure regardless of where it’s physically based — may have no way to act on just that one address. The result is collateral disruption to unrelated account holders, businesses, and platforms that had no notice, no designation, and no direct role in the underlying conduct.
⚠️ Time is critical — every day matters
Get a free case assessment
Our team specialises in cases with an international element. We review applicable treaties, assess risks, and prepare an action plan.
What This Means If Your Funds or Access Were Blocked
The t.me incident is a clear illustration of a pattern our clients encounter regularly, just at a different layer of infrastructure: a name, address, domain, or identifier connected — however loosely — to an OFAC action can trigger a block that has nothing to do with the person or business actually affected.
- A bank freezes a wire transfer because an automated screening tool flagged a name or transaction detail resembling something on the SDN List — often a false positive with no real connection to the designated party.
- A payment processor, registry, or counterparty blocks access preemptively to avoid its own compliance exposure, without waiting for OFAC to confirm the block was warranted — exactly what appears to have happened here at the domain level.
- No one affected receives a clear, timely explanation. As with t.me, the actual cause may only surface days later, through press reporting or third-party confirmation, rather than direct notice from the agency or the entity that applied the block.
If you’re on the receiving end of a block like this — a frozen account, a blocked wire, a suspended service, or a name added to the SDN List because of a tenuous or mistaken connection — the resolution path depends entirely on which of these applies to your case:
- False positive: typically resolved in 1–4 weeks by submitting identity documentation showing you’re not the party actually listed.
- Block tied to a sanctioned jurisdiction or counterparty: requires a formal unblocking petition or a specific OFAC license, generally 4–12 weeks, sometimes longer.
- Actual SDN designation: requires a delisting petition, the most involved process, often taking six months to several years.
What you should not do in any of these scenarios: try to reroute the transaction, move funds through another channel, or pressure a bank or provider to release funds without legal clearance. Any of that can open an independent OFAC investigation on top of the original block.
If your funds, accounts, or business operations have been affected by an OFAC-linked block — even one that seems to have been triggered indirectly, the way t.me’s domain was — the first step is identifying exactly which legal remedy applies, then acting on it immediately. Delay is the single biggest factor that extends these timelines.
