type.inbound
and any(body.links,
.href_url.domain.domain == "storage.googleapis.com"
// token in the fragment/query
and any([.href_url.fragment, .href_url.query_params],
regex.icontains(.,
'\b\d{7}[a-z]{2}\d{7,8}[a-z]{2}\d{9}[a-z]{2}\d{3,5}[a-z]{2}24[a-z]{2}[ru]\d{6}[a-z]{2}\b'
)
)
)
Playground
Test against your own EMLs or sample data.