Telegram to disguise traffic as regular web browsing — new proxy hides MTProxy inside HTTPS

Researchers have discovered a new type of proxy being prepared in the Telegram Desktop code — a WEB-proxy designed to disguise the messenger's traffic as ordinary HTTPS/WebSocket connections, making it look like regular website visits. The relevant strings were found in the client's source code.

The core technology works by packing multiple Telegram connections into a single stream, which is then transmitted through an embedded WebView. A relay server on the receiving end unpacks this stream into separate connections and forwards them to MTProxy without any decryption. To an internet service provider, this traffic appears as standard web browsing, making deep packet inspection significantly more difficult.

The mechanism operates as follows: Telegram Desktop opens a mini-browser and establishes an HTTPS/WebSocket connection to a domain that looks like a regular website. All MTProxy traffic is hidden within a single stream and transmitted through this disguised web channel. The domain simultaneously serves a normal website to regular visitors, while a special "bridge" page is only revealed to Telegram clients after a verification check. As a result, the entire traffic flow imitates ordinary web browsing.

This new proxy type could be particularly useful in countries where Telegram is blocked or its traffic undergoes deep packet analysis. The WEB-proxy would allow users to bypass such restrictions without drawing the provider's attention. The feature is expected to appear in one of the upcoming messenger updates. The development suggests Telegram is actively working on more sophisticated methods to maintain accessibility in restrictive network environments, building on its existing MTProxy infrastructure.