sublimemediumRule

Link: Telegraph-hosted content

Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and any(body.links, .href_url.domain.root_domain in ("telegra.ph", "graph.org"))

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Telegraph-hosted content"
description: "Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links, .href_url.domain.root_domain in ("telegra.ph", "graph.org"))
  
tags:
  - "Attack surface reduction"
attack_types:
  - "Spam"
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Free file host"
detection_methods:
  - "URL analysis"
id: "a1ccdfa2-4945-545f-a90c-08f9ac1bf458"