Rule-level detection for Google Cloud Storage links that include an od= affiliate tracking token embedded in the URL fragment. The token pattern describes a header portion with a 13-hex-like counter, followed by segments that encode account/record identifiers, and a 5-character echo of the record before a base64 tail. The rule triggers on inbound messages containing such links to storage.googleapis.com, regardless of whether a redirect.html fragment is present. This pattern is observed in fake account suspension, payment, and prize spam campaigns and serves to detect coordinated phishing/advertising abuse leveraging GCS links.