I’ve been a big fan of Ryan Benson’s unfurl[1] tool since he released it a little over 5 years ago. Unfurl is a tool that can parse/decode URLs including things like embedded timestamps and IP addresses. It can be run in gui form via a web browser or as a command-line tool (my preference). Well, last week, Ryan released an update to v2025.02[2,3] of unfurl and added the ability to decode BlueSky URLs (among other bugfixes). I’ve also updated my docker container[4] to run the command-line version of unfurl as well.

References:

1. https://dfir.blog/introducing-unfurl/

2. https://dfir.blog/unfurl-parses-obfuscated-ip-addresses/

3. https://github.com/obsidianforensics/unfurl

4. https://hub.docker.com/repository/docker/clausing/dfir-unfurl/general

—————
Jim Clausing, GIAC GSE #26
jclausing –at– isc [dot] sans (dot) edu

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.