[xg15]

I think Google can still cluster Telegram users pretty easily, especially now that that the method is in the open.

Yes, Telegram fakes the user-agent, but the rest of the request still looks very different from a request an actual browser would do. (No referrer, missing headers, different connection pooling behaviour, possibly different TLS and HTTP2 behaviour, etc).

So if Google is doing any detection for browser vs non-browser requests, those requests should show up as suspicious.

[nothasan]

If they used cronet, they could get past these checks.