Decode a compressed blob and report its URL

Decode Base64, decompress Gzip, extract printable strings, isolate URLs, defang them, and remove duplicates.

Install in Serialize

What it can do

Cross encoding and compression layers
Find printable material in mixed bytes
Extract, neutralize, sort, and deduplicate URLs

How the recipe works

From Base64

Decode the Base64 transport layer.

Gunzip

Decompress the Gzip member.

Strings

Recover printable single-byte runs.

Extract URLs

Select complete URLs.

Defang URL

Defang active-looking syntax.

Sort

Sort the report lines.

Unique

Remove repeated entries.

Demonstration

Sample input

H4sIAAAAAAAAE2NgZMooKSkottLXT8lPLtZLrUjMLchJ1StJLS7RL0iszMlPTGH4LwAAnjhM2ScAAAA=

Expected result

hxxps[://]docs[.]example[.]test/payload

When to use it

Static blob triage
Forensics classes
Building a reproducible indicator report

Adapt it

Raise the minimum string length to reduce noise, or append SHA-256 when the original artifact also needs an integrity value.

Source and verification

Adapted from mattnotmax CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.