This rule detects inbound messages that contain URLs pointing to telegraphs hosting domains telegra.ph or graph.org. These sites are free content-hosting platforms widely used to mask the final redirect destination and improve email deliverability. The rule targets social-engineering and spam campaigns that use these legitimate hosting services to surface redirect pages and lure users into phishing or other malicious content. Observed samples include dating/romance pitches, pharmacy/medication marketing, generic curiosity bait, and other unsolicited outreach, with senders originating from free webmail, dubious domains, or spoofed corporate addresses. The shared tactic is leveraging trusted, free hosting to obfuscate the true destination. Detection is performed via URL analysis on inbound messages, evaluating if any linked URL has a root_domain of telegra.ph or graph.org. This enables preemptive filtering of potential phishing or spam lures before users click through. The rule is suitable for endpoint protection and can complement broader email security controls that assess link reputation and behavioral signals.