Link: Telegraph-hosted content
Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability.
Sublime rule (View on GitHub)
1name: "Link: Telegraph-hosted content"
2description: "Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and any(body.links, .href_url.domain.root_domain in ("telegra.ph", "graph.org"))
8
9tags:
10 - "Attack surface reduction"
11attack_types:
12 - "Spam"
13 - "Credential Phishing"
14tactics_and_techniques:
15 - "Social engineering"
16 - "Free file host"
17detection_methods:
18 - "URL analysis"
19id: "a1ccdfa2-4945-545f-a90c-08f9ac1bf458"