Someone told you to grab a Telegram proxy from GitHub, or you came across that advice yourself. You open GitHub and find thousands of stars, releases with .exe and .apk files, and almost every repository saying that everything is working, tested and updated every hour. It's hard to know what to believe, and whether you'll pick up a virus along the way.
Let me say this up front: we sell personal proxies ourselves, so I'm an interested party here, keep that in mind. On top of that, our code is closed and isn't on GitHub, so you can't check us the ways I describe below. But more about us at the end.
What you find when you look for a proxy on GitHub
GitHub doesn't check what people upload in advance. Anyone can put anything there: code, a text file, a ready-made program, and the site adds no mark of quality to it. Search GitHub for "telegram proxy" and you get thousands of repositories, and the top twenty by stars are a mix of a desktop program, server software, "one-click" installers, address lists and projects that have nothing to do with it.
The official Telegram repository isn't in that top twenty, although it exists. It's called TelegramMessenger/MTProxy, and Telegram itself links to it in its documentation. But it's server software that you install on your own Linux server to share a proxy with other people. There's no phone app and no ready list of addresses in it, so someone without their own server has nothing to take from it. There's third-party server software there too, with thousands of stars, but that's for server administrators and isn't what we're talking about here.
You probably weren't looking for server software anyway. People who search for this usually want a ready list of links or a program to download to their computer or phone, and GitHub hands out both, right down to Android APK files from personal accounts with no license at all. I'll cover each separately below, because the risks are different. Copies of the Telegram client itself with someone else's changes (forks) are something I'd stay away from straight away. One such copy turned up near the top of search results for a query about a proxy for iPhone in October 2026. Compared with the official iOS client on 18 October 2026, it was 1,820 changes behind, and it was last updated in April, so everything Telegram has released since then has passed it by.
Don't the stars mean anything?
You probably read GitHub stars the way you read reviews. But stars get bought. GitHub's rules explicitly ban automated starring, and still researchers found about six million suspicious stars, with most of the fake ones going to short-lived repositories with phishing and malware. That's why a thousand stars on an unfamiliar project doesn't reassure me.
Fresh changes (commits) are a similar story. "Updated a few minutes ago" looks like a sign of a living project, but it isn't hard to fake on purpose. Kaspersky researchers reported a campaign called GitVenom: more than two hundred repositories on GitHub with malicious code posing as open-source projects, including a Telegram bot. The number of changes was pumped up with a timestamp file that was updated every few minutes, and most of the attacks were recorded in Russia, Turkey and Brazil. With proxy lists, the fresh changes come from a bot that re-uploads the file, and they say nothing about the quality of the addresses either.
The "Verified" badge doesn't help much either. An organization gets it by confirming its domain, and it says nothing about the code. Funnily enough, Telegram's own organizations on GitHub don't have the badge, neither the one behind MTProxy nor the one behind Telegram Desktop. What sets the real thing apart isn't stars or a badge, it's the fact that Telegram itself links to it. The Telegram apps page lists the official repositories, and unofficial clients are labelled "Unofficial". The Telegram Desktop site links to telegramdesktop/tdesktop, and the proxy documentation links to TelegramMessenger/MTProxy. If you really need a repository, find it through a link on Telegram's site or the author's own site, not through search: search is happy to take you to copies instead of the originals.
What's inside the popular lists
A list on GitHub collects other people's addresses and re-uploads the file every few hours, without saying whose servers they are. In effect it's the same free proxies run by strangers, just in different packaging. Telegram's proxy help page says plainly that the server owner can't read your messages but can collect your IP, the times you connect and the very fact that you use Telegram. It advises using proxies only from a trusted source, or asking someone you know to set up their own.
Some things can be seen from the file history on GitHub. One popular list, which a bot updates every twelve hours, had 145 addresses on 18 October 2026. Of the 234 that were in it on 18 September, 59 were still there, roughly a quarter. Disappearing from a list doesn't prove that a server died, though, since the script itself could have removed it. Those 145 addresses use only 21 different secrets, and one and the same secret appears on 50 addresses. The secret is set by whoever runs the server, so it looks as if one person is behind dozens of "different" addresses. There's no proof of that, it's an assumption.
The word "tested" is tricky too. The description of that same list promises that every line works and that a script checks the addresses before publishing, but there's no code for that check in the repository: just a description in four languages and a file of links. Another popular list does have open code, and reading it shows that "testing" only means the server has an open port. Whether there's a Telegram proxy behind it, and whose, you can't tell that way. Its sorting "by speed" doesn't actually work, because the code measures speed only after the connection is made, and on 18 October 2026 the results file listed it as zero for all hundred addresses (ping: 0.0).
The same list boasts that it collects addresses from more than forty-five sources. A comparison on 18 October 2026 of one of its country files with a third list shows that 92 addresses out of a hundred have the same secret and the same domains as the servers the third list openly calls "our servers". So a collector with dozens of sources seems to have a country file made up almost entirely of one owner's servers. And at the very bottom of that third list's description there are two hundred links to "guides" and "instructions", most of them on throwaway pages. Of six accounts checked at random, four no longer exist, and two were created on 17 September a minute apart. I don't know for sure what they're for, it looks like a network of pages made for search engines.
Why I wouldn't download a program just to get a link
You don't need to download anything to use a proxy link. All Telegram apps, on phones and on computers, can connect through a proxy on their own, there's more on that in the article about Telegram proxies.
A proxy only sees Telegram's encrypted traffic, while a program you run works on your device with your permissions, so in my view a file from an unfamiliar repository is more dangerous than any link. Stealers, programs that steal passwords and payment details, get passed around disguised as popular programs. In the repository of one popular desktop program, someone complained that their antivirus had found a stealer in its .exe file. The author replied that the file hadn't been downloaded from his repository, that it was a stealer posing as the real file, and that anyone who had run it should change their passwords and log out of all sessions. In the same place he writes that this had already happened to someone who found the program through a search engine. The same program also has a lookalike site that looks more solid than the original, and its download buttons lead to someone else's repository created in September.
If you still choose a Telegram proxy from GitHub, you don't need to read code to do it. What matters most is who published the repository and whether the original source, Telegram's site or the author's own site, links to it. Sometimes the promised code isn't there at all, only a description and a file of links, and then the word "tested" has nothing behind it. The same secret on a hundred addresses is easy to spot by eye, because it sits at the end of every link like t.me/proxy?server=example.com&port=443&secret=…. People complain in the Issues tab, and that's exactly where the stealer story above came from. And the description on the main page is often selling something else, so the list turns out to be a shop window for someone's channel or bot.
If you've already downloaded and run something suspicious:
- In Telegram, open Settings → Devices (or Privacy and Security → Active Sessions) and end any sessions that aren't yours.
- Change your passwords, which is what the author of that program advises too.
- Never share your Telegram login code with anyone, not with people and not with other services or apps, however politely they ask.
If you'd rather not work out whose server it is
And now, as promised, about us. If you don't want to dig into whose server is behind a link from a list, you can get a proxy from someone you can see. FreeGate is a personal MTProto proxy that connects with a single link in the official Telegram app, with no programs and no downloads: Telegram itself asks about the proxy, and you tap "Connect Proxy". The proxy works only inside Telegram, while your banking app and all your other apps go online directly. Each device gets its own link, and if it leaks, you change it in your account with one tap and the old one stops working at once. We can't see your messages, Telegram encrypts them itself.
You can try it for free: 1 day after you sign up with an email and confirm your address, with no payment and no automatic charges. After that it's $1.00 for 30 days or $2.50 for 90 days, price per device, so for a phone and a computer choose 2 when buying. It works in the official Telegram apps for iOS, Android, Windows, macOS and Linux, details at freegate.app/world.