There are many query string parameters in Google Search URLs that hold interesting information. The rlz parameter is no exception, but thankfully it isn't as mysterious as many others; Google explains what the RLZ parameter is and how it functions in a white paper. From the Google Chrome Privacy Whitepaper:| dfir.blog
Unfurl v2025.03 adds new features, including parsing Google Search's UDM parameter, support for Mastodon forks (like Truth Social), and a utility parser to "clean up" inputs.| dfir.blog
Unfurl v2025.02 adds parsing of obfuscated IP addresses, more Bluesky timestamps, and more!| dfir.blog
I watch Netflix's Carry-On, notice a real Google Search URL on screen, extract lots of data points from it and "authenticate" the screenshot.| dfir.blog
Unfurl v2023.09 adds parsing for JWTs, URLs with encoded DoH (DNS over HTTPS) requests, and more Mastodon servers.| dfir.blog
This "social media edition" Unfurl release includes parsing Twitter sharing codes, timestamps from Mastodon and LinkedIn IDs, expanding Substack redirects, & more!| dfir.blog
Unfurl v2022.02 adds parsing for Google Search's aqs parameter, integrates MISP "warninglists", adds 3x more shortlink expansions, and more!| dfir.blog
A new Unfurl release is here! v2021.06.15 adds decoding of some Metasploit URLs, hash identification and API lookups, more control over remote lookups, better UUID parsing, and a few more shortlink expansions. It also has a number of smaller fixes, code cleanups, and tests.| dfir.blog
I'm happy to announce there is a new Hindsight release available! 2021.04.26 has many small improvements and fixes, including adding support Chrome 88 - 90, but the main new features are an Unfurl plugin and parsing of the Site Characteristics Database! Unfurl Plugin I'm excited that this new| dfir.blog
I tinker with TikTok - and find a timestamp embedded in video URLs!| dfir.blog