During a hypothesis-driven hunt, a threat hunter suspects that attackers are delivering payloads disguised with uncommon file extensions over HTTP. They want a YARA-L 2.0 hunting rule that surfaces web downloads where the combination of the downloaded file's extension and the responding server is observed on only a very small number of distinct hosts across the enterprise over a 14-day baseline. Which YARA-L construct is MOST appropriate to express this low-prevalence condition without pre-building a reference list?