Detects inbound Google Cloud Storage links where the fragment is base64-encoded and decodes to another base64 string, indicating a potential actor-controlled redirect token pattern used in reward and account suspension spam. The rule targets links hosted on storage.googleapis.com, requiring the fragment to match a high-entropy base64 pattern (100-160 chars, with up to 2 padding '=') and, after decoding (ignoring padding), to match another base64 pattern of 80-120 chars. This double-encoding is a common evasion technique to bypass URL filters and lure victims with redirection tokens. The rule uses URL analysis on inbound traffic to identify such patterns in href fragments and is aligned with spam/phishing workflows that rely on external file hosting redirects.