Link: Telegraph-hosted content

Inbound messages containing links that point to telegra.ph or graph.org, the free Telegram-run publishing platform, which is abused to host redirect pages for spam and low-effort social engineering lures. Observed samples span dating/flirting pitches, pharmacy and medication marketing, generic curiosity-bait subject lines, and other unsolicited outreach, with senders coming from free webmail providers, questionable domains, or spoofed corporate addresses. The shared trait is use of a legitimate, free content-hosting service to mask the true destination and improve deliverability.