Detects inbound messages containing exactly two Google Cloud Storage (storage.googleapis.com) links that serve the same file from two buckets where one bucket name is the other bucket name plus a suffix (e.g., 'unsb'). The rule parses all links in the message body, filtering for storage.googleapis.com, and extracts the bucket and object trailer from each link path. It requires exactly two distinct paths, then compares the bucket/trailer pairs to identify a pair where the second bucket starts with the first (i.e., the same trailer/object name) but with a suffixed bucket name. This behavior matches observed campaigns (bulk health-supplement, reward survey, fake storage-alert) that use two similar links to entice clicks while evading simple URL checks. Detection relies on URL analysis and path regex extraction rather than payload content, enabling recognition of this suspicious two-link pattern even if one link is superficially similar to the other.