Link: Google Cloud Storage with suspicious URL pattern

type.inbound
and any(body.links,
        // storage.googleapis.com
        .href_url.domain.domain == "storage.googleapis.com"
        // observed pattern in actor controlled url path
        and regex.match(.href_url.path,
                        '\/(?:[a-z0-9]+-)+\d{8}(?:\-[a-z0-9]+)+\/[^\/]+\.html'
        )
)