Link: Google Cloud Storage hosted credential harvesting page

type.inbound
and any(body.links,
        (
          .href_url.domain.domain == "storage.googleapis.com"
          and regex.icontains(.href_url.path,
                              '^\/(?:[^-]+\-+)+[0-9a-f]{20}\/index\.html$'
          )
        )
        // workstream endcodes the URLs with sendgrid, if we click them, we can see if they redirect to the same strcuture
        or (
          .href_url.domain.domain == "sendgridlinks.workstream.is"
          and any(ml.link_analysis(., mode="aggressive").redirect_history,
                  .domain.domain == "storage.googleapis.com"
                  and regex.icontains(.path,
                                      '^\/(?:[^-]+\-+)+[0-9a-f]{20}\/index\.html$'
                  )
          )
        )
)