Detects inbound emails that contain hyperlinks to storage.googleapis.com where the URL path is a hexadecimal hash followed by .html (e.g., /[a-f0-9]{8,32}.html). This pattern is commonly used by attackers to host phishing or credential-harvesting pages on Google Cloud Storage. The rule operates via URL analysis of email content, checking that any link’s domain ends with storage.googleapis.com and that the path matches the specified hex-HTML format. Triggering at a medium severity, it helps identify potential credential phishing campaigns that leverage public cloud storage as a hosting vector. False positives may occur if legitimate content uses hashed HTML filenames on GCS; consider additional signals (sender reputation, landing page analysis, and content context) to improve precision.