Unfurl

No entries match these filters. Clear filters

1. v2026.11 Oct 29, 2026 · issue 124

   Unfurl adds ETag, ChatGPT/OpenAI ID, and Firebase Push ID parsers for deeper URL forensic analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.11 https://github.com/RyanDFIR/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2026.11

   └──▷ TRY IT
   Decode an image URL containing an Apache-style ETag in a query parameter to recover the origin file size and modification time.
   copy

   $ unfurl "https://example.com/image.jpg?etag=%22f4381-6385a594%22"

   • Unfurl now parses ETagsETagsHTTP response headers that identify a specific version of a resource, letting clients skip re-downloading unchanged content; cyber tools use them to detect when monitored assets have been silently modified. found in etag query parameters or quoted header values ("..." or W/"...") and decodes layouts from Apache httpd, nginx, and Node.js, extracting file size, mtime (seconds, milliseconds, or microseconds), inode, and compression suffix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Unfurl now parses ChatGPT and OpenAI IDs embedded in URLs.
   • Unfurl now parses Firebase Push IDs embedded in URLs.
   • Unfurl now converts WebKit, WebKit milliseconds, Windows FileTime, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. v1/v6 timestamps with integer math instead of floating-point, preserving source precision (three digits for WebKit milliseconds, six for WebKit, seven for FileTime and UUID times).
   • Unfurl now parses ETagsETagsHTTP response headers that identify a specific version of a resource, letting clients skip re-downloading unchanged content; cyber tools use them to detect when monitored assets have been silently modified. found in etag query parameters or quoted header values ("..." or W/"...") and decodes layouts from Apache httpd, nginx, and Node.js, extracting file size, mtime (seconds, milliseconds, or microseconds), inode, and compression suffix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Unfurl now parses ChatGPT and OpenAI IDs embedded in URLs.
   • Unfurl now parses Firebase Push IDs embedded in URLs.

   1 more in Everything

2. v2026.09 Sep 16, 2026 · issue 077

   Unfurl v2026.09 adds parsers for Gmail, Safe Links, Facebook, Instagram, GitHub, Fernet/itsdangerous tokens, defanged IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and more, plus Tree/Text/dark-mode UI and a layered config system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.09 https://github.com/RyanDFIR/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2026.09

   └──▷ TRY IT
   Unfurl a Safe Links-wrapped URL from a phishing email to recover the original destination, recipient GUID, and scan verdict without sending data to external services.
   copy

   $ unfurl 'https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fevil.example.com%2Fpayload&data=05%7Crecipient-guid%7C...'

   Refang a defanged IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. from a threat report and extract all embedded structure in one step.
   copy

   $ unfurl 'hxxps://evil[.]example[.]com/payload[.]exe'

   Store your VirusTotal key and enable remote lookups in a gitignored local config so they apply to every run without touching the tracked unfurl.ini.
   unfurl.local.ini copy

   [UNFURL_APP]
   remote_lookups = true
   
   [API_KEYS]
   virustotal = <your key>

   • Adds UNFURL_BITLY_API_KEY, UNFURL_VIRUSTOTAL_API_KEY, and UNFURL_GOOGLE_KG_API_KEY environment variables for API key configuration, replacing the old bare lowercase names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds UNFURL_REMOTE_LOOKUPS environment variable to enable or disable remote lookups from the environment, overriding both config files.
   • Adds unfurl.local.ini as a gitignored, user-local config overlay that overrides unfurl.ini without risking committed secrets.
   • Adds YAML-based site definitions system (see unfurl/parsers/site_defs/README.md) to teach Unfurl a site's URL structure without writing Python.
   • Adds Google /aclk ad click URL parsing with parameters adurl, ai, gclid, sig, and more via google.yaml.

   +23 more show less

   • New parser for Gmail legacy hex and new-style (2018+) URL tokens, decoding to Gmail IDs and embedded timestamps; handles th, compose, permmsgid, permthid, and projector.
   • New parser for Microsoft Defender Safe Links, extracting the wrapped destination URL and pipe-delimited data field (format versions 01 through 05): recipient, message and tenant GUIDs, timestamp, scan verdict, and scan payload.
   • New parser for Facebook URL paths (posts, photos, videos, groups, events, stories, pages, Marketplace, profiles, comments) and decoding of modern fbclid values (browser ID, app ID, ad ID, AEM hash).
   • New parser for Instagram posts, reels, stories, highlights, and profiles, with shortcodes and story IDs decoded to creation timestamp, shard ID, and sequence number.
   • New parser for GitHub URLs covering repos, commits, issues, PRs, branches, releases, Actions runs, compare views, OAuth flows, and line-number fragments.
   • New parser for Fernet tokens extracting version, cleartext creation timestamp, IV, ciphertext, and HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.; includes the re-padded form used by ChatGPT Ads click IDs (oppref, olref).
   • New parser for itsdangerous signed tokens (used by Flask and other Python web apps), extracting payload (decompressed if needed), signing timestamp, and signature.
   • New parser for MongoDB ObjectIDs and their embedded timestamps.
   • New parsers for Base32 and Base58 encoding.
   • New parser for defanged indicators (e.g. hxxps://evil[.]com/payload[.]exe, 1.2.3[.]4, user[at]evil.com), refanging them into a new node with a hover listing every replacement made.
   • New parser for file extensions, identifying file type and flagging extensions commonly abused to deliver malware.
   • Parses Text Fragments (#:~:text=) and SPA-style fragment routes (#/route?key=value).
   • Parses ;-delimited key=value pairs in URLs, as used by ad servers and path parameters.
   • Adds UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. version 6, 7, and 8 support, with timestamps extracted from v6 and v7.
   • Adds new timestamp formats: WebKit milliseconds, Epoch nanoseconds, PostgreSQL, and Mac Absolute Time nanoseconds.
   • Adds Bing form code parsing (including indexed variants) and image search parameters (thid, mediaurl, sbifnm, iss, view, and more).
   • Adds 40 more shortener domains including aka.ms, flic.kr, redd.it, pin.it, t.cn, and wa.link, plus Constant Contact click-tracking links.
   • Adds Tree and Text views alongside the Graph in the web UI, with copy-to-clipboard for the text tree.
   • Adds dark mode to the web UI, with user preference remembered.
   • Tests now ship with the package, enabling validation of an installed copy with python -m unittest discover -s unfurl.tests.unit.
   • Layered configuration now reads unfurl.ini, then unfurl.local.ini, then UNFURL_* environment variables, then CLI flags, with each layer overriding the last.
   • Epoch seconds auto-detection now covers 2010 onward (previously 2015).
   • Discord snowflakes created after July 2022 are now decoded in general Discord URL paths, and snowflakes in query values and token payloads on Discord domains are decoded.
   • Adds UNFURL_BITLY_API_KEY, UNFURL_VIRUSTOTAL_API_KEY, and UNFURL_GOOGLE_KG_API_KEY environment variables for API key configuration, replacing the old bare lowercase names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds UNFURL_REMOTE_LOOKUPS environment variable to enable or disable remote lookups from the environment, overriding both config files.
   • Adds unfurl.local.ini as a gitignored, user-local config overlay that overrides unfurl.ini without risking committed secrets.
   • Adds YAML-based site definitions system (see unfurl/parsers/site_defs/README.md) to teach Unfurl a site's URL structure without writing Python.
   • New parser for Gmail legacy hex and new-style (2018+) URL tokens, decoding to Gmail IDs and embedded timestamps; handles th, compose, permmsgid, permthid, and projector.

   +16 more show less

   • New parser for Microsoft Defender Safe Links, extracting the wrapped destination URL and pipe-delimited data field (format versions 01 through 05): recipient, message and tenant GUIDs, timestamp, scan verdict, and scan payload.
   • New parser for Facebook URL paths (posts, photos, videos, groups, events, stories, pages, Marketplace, profiles, comments) and decoding of modern fbclid values (browser ID, app ID, ad ID, AEM hash).
   • New parser for Instagram posts, reels, stories, highlights, and profiles, with shortcodes and story IDs decoded to creation timestamp, shard ID, and sequence number.
   • New parser for GitHub URLs covering repos, commits, issues, PRs, branches, releases, Actions runs, compare views, OAuth flows, and line-number fragments.
   • New parser for Fernet tokens extracting version, cleartext creation timestamp, IV, ciphertext, and HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.; includes the re-padded form used by ChatGPT Ads click IDs (oppref, olref).
   • New parser for itsdangerous signed tokens (used by Flask and other Python web apps), extracting payload (decompressed if needed), signing timestamp, and signature.
   • New parser for MongoDB ObjectIDs and their embedded timestamps.
   • New parsers for Base32 and Base58 encoding.
   • New parser for defanged indicators (e.g. hxxps://evil[.]com/payload[.]exe, 1.2.3[.]4, user[at]evil.com), refanging them into a new node with a hover listing every replacement made.
   • New parser for file extensions, identifying file type and flagging extensions commonly abused to deliver malware.
   • Parses Text Fragments (#:~:text=) and SPA-style fragment routes (#/route?key=value).
   • Parses ;-delimited key=value pairs in URLs, as used by ad servers and path parameters.
   • Adds Tree and Text views alongside the Graph in the web UI, with copy-to-clipboard for the text tree.
   • Adds dark mode to the web UI, with user preference remembered.
   • Tests now ship with the package, enabling validation of an installed copy with python -m unittest discover -s unfurl.tests.unit.
   • Layered configuration now reads unfurl.ini, then unfurl.local.ini, then UNFURL_* environment variables, then CLI flags, with each layer overriding the last.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The old bare lowercase API key environment variable names (bitly, virustotal, google_kg) are deprecated and log a warning — rename them to UNFURL_BITLY_API_KEY, UNFURL_VIRUSTOTAL_API_KEY, and UNFURL_GOOGLE_KG_API_KEY.
3. v2026.04 Apr 5, 2026 · release notes

   Unfurl v2026.04 adds stash, proto, Google Knowledge Graph parser, and JSON list support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.04 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2026.04

   • Allows JSON inputs to be parsed directly as top-level lists (arrays) without wrapping objects

   1 detail in Everything

4. v2025.08 Aug 10, 2025 · release notes

   Unfurl v2025.08 adds TikTok ID parsing with milliseconds/sequence and epoch timestamp utility

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2025.08 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2025.08

   • Adds datetime.UTC as tzinfo for timestamp nodes
   • Update TikTok ID parsing to include milliseconds, sequence, entity type, and machine ID
   • Add utility function to create epoch timestamps for a date

   3 details in Everything

5. v2025.03 Mar 12, 2025 · release notes

   Unfurl v2025.03 adds parsing for Mastodon instances (truthsocial.com, gab.com), Google udm parameter, and raises timestamp ceiling to 2030

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2025.03 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2025.03

   • Add parsing of Mastodon usernames and RSS URLs; add truthsocial.com and gab.com to the Mastodon parser
   • Google updates - add parsing of udm parameter and modify two-parent nodes
   • Increase maximum reasonable timestamp to 2030

   3 details in Everything

6. v2025.02 Feb 18, 2025 · release notes

   Unfurl v2025.02 adds Bluesky DID lookup and IP address parsing in hostnames

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2025.02 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2025.02

   └──▷ TRY IT
   Resolve a Bluesky handle to its DID and print the creation timestamp
   copy

   $ unfurl --bsky-did https://bsky.app/profile/example.com

   Extract an embedded IP address from a hostname for forensic analysis
   copy

   $ unfurl --parse-ip-in-hostname https://192.168.1.1.evil.com/path

   • Adds --bsky-did flag to resolve a Bluesky handle to its DID and fetch the DID creation timestamp from the audit log.
   • Adds --parse-ip-in-hostname option to detect and extract embedded IPv4 addresses from hostname strings.

   2 details in Everything

7. v2024.11 Nov 21, 2024 · release notes

   Adds Bluesky TID parser and tightens b64+proto parsing filters

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2024.11 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2024.11

   • Adds a dedicated parser for Bluesky TIDs (timestamp ids)
   • Tightens b64+proto parsing to filter out entries containing all digits or all number paths
   • Adds support for x.com domains in the Twitter parser

   3 details in Everything

8. v2023.09.05 Sep 17, 2023 · release notes

   Adds parse_jwt.py for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. parsing and DNS DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. URL parser to Unfurl v2023.09.05

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2023.09.05 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2023.09.05

   • parse_jwt.py added to parse JSON Web Tokens with supporting functions
   • Parser added for DNS DoH URLs

   2 details in Everything

9. v2022.11 Nov 7, 2022 · release notes

   Unfurl v2022.11 adds LinkedIn profile parsing, Substack expansion and run/print_tree functions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2022.11 https://github.com/obsidianforensics/unfurl.git
   # already have the repo? check out this version:
   $ git checkout v2022.11

   └──▷ USE IT
   Execute an unfurl analysis programmatically and print the results as a hierarchical tree in Python or Jupyter.
   python copy

   import unfurl
   unfurl.run(url)
   unfurl.print_tree()

   • Add expansion of Substack redirects to link shortening parser.
   • run
   • Add parsing of LinkedIn URLs: Messages (v1 and v2), Profile IDs, and …
   • Use flask-restx for the API

   4 details in Everything

10. v2022.02 Feb 10, 2022 · release notes

    Unfurl v2022.02 adds parsers for Brave Search and Google aqs, MISP enrichment, Twitter snowflake decoding, multi-parent nodes, and LinkedIn shortener lookups.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2022.02 https://github.com/obsidianforensics/unfurl.git
    # already have the repo? check out this version:
    $ git checkout v2022.02

    • Adds parser for Brave Search
    • Add parsing for Google Search aqs parameter
    • Use MISP warning lists to enrich domain names
    • Add MISP's list of URL shortener domains to parse_shortlink.py
    • Decode snowflake IDs from Twitter image attachment names

    +2 more show less

    • Adds support for nodes to have multiple parents
    • Add URL redirect lookup for another type of Linkedin link shortener

    7 details in Everything

11. v2021.06.15 Jun 14, 2021 · release notes

    Unfurl v2021.06.15 adds remote hash lookups via -l, Metasploit URL parsing, and new link shortener support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2021.06.15 https://github.com/obsidianforensics/unfurl.git
    # already have the repo? check out this version:
    $ git checkout v2021.06.15

    └──▷ USE IT
    Run remote lookups to identify hashes from an online database instead of relying on local data.
    shell copy

    unfurl -l urls.txt

    Parse URLs generated by the Metasploit framework to extract embedded parameters and targets.
    shell copy

    unfurl 'http://attacker/m/msf?p=1&cmd=id'

    • -l flag to enable remote hash identification lookups (disabled by default)
    • New detection for UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. v1 addresses containing random MACs
    • Parser now handles some Metasploit URLs
    • Support added for t.ly and urlwee.com link shorteners

    4 details in Everything

12. v2021.03.11 Mar 11, 2021 · release notes

    Unfurl v2021.03.11 adds Yahoo Search parsing, Laravel Ordered UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. support, and file extension extraction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2021.03.11 https://github.com/obsidianforensics/unfurl.git
    # already have the repo? check out this version:
    $ git checkout v2021.03.11

    • Adds --yahoo-search flag to parse Yahoo Search URLs
    • Adds --laravel-ordered-uuid flag to parse Laravel Ordered UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
    • Adds automatic file name and extension parsing when present in the URL path

    3 details in Everything

13. 20201102 Nov 4, 2020 · release notes

    Adds parsing for Epoch Hex/FileTime Hex timestamps, bare TikTok IDs, and a new UI examples page

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20201102 https://github.com/obsidianforensics/unfurl.git
    # already have the repo? check out this version:
    $ git checkout 20201102

    └──▷ USE IT
    Parse a Unix epoch hex value directly into a human-readable timestamp.
    shell copy

    unfurl -p epoch_hex https://example.com?t=5F204E80

    Parse a Microsoft FileTime hex value to determine file creation/modification time.
    shell copy

    unfurl -p filetime_hex https://example.com?t=01D5A4B8C9E20000

    Extract a TikTok creator's ID from a short link where the ID is not in the URL path.
    shell copy

    unfurl -p tiktok_bare_id https://vm.tiktok.com/ZS8j9Kz1/

    • epoch_hex parser added to handle Epoch Hex timestamp formats
    • filetime_hex parser added to handle FileTime Hex timestamp formats
    • tiktok_bare_id parser added to parse TikTok IDs not present in the URL
    • New examples page added to the main Unfurl UI screen

    4 details in Everything

14. 20200812 Aug 12, 2020 · release notes

    Unfurl 20200812 adds TikTok, YouTube, and Sonyflake ID parsing plus generic QSP support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 20200812 https://github.com/obsidianforensics/unfurl.git
    # already have the repo? check out this version:
    $ git checkout 20200812

    • Adds generic QSP parsing for lang and language query parameters

    1 detail in Everything