Safari only records that file should be quarantined, not the URL. Here are the extended attributes for an image downloaded by Safari in Sierra: ecthelion ~>

Safari only records that file should be quarantined, not the URL. Here are the extended attributes for an image downloaded by Safari in Sierra: ecthelion ~>xattr -l Downloads/fm_800-2.jpg com.apple.quarantine: 0083;5c8aa472;Safari;1021CF85-4F78-492B-A8E3-766C44A3A671 Here is the equivalent in Chrome Canary: ecthelion ~>xattr -l Downloads/fm_480.jpg com.apple.metadata:_kMDItemUserTags: 00000000 62 70 6C 69 73 74 30 30 A0 08 00 00 00 00 00 00 |bplist00........| 00000010 01 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 00 09 |..........| 0000002a com.apple.metadata:kMDItemWhereFroms: 00000000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 29 68 74 |bplist00..._.)ht| 00000010 74 70 73 3A 2F 2F 62 6C 6F 67 2E 6D 61 6A 69 64 |tps://blog.majid| 00000020 2E 69 6E 66 6F 2F 69 6D 61 67 65 73 2F 66 6D 5F |.info/images/fm_| 00000030 34 38 30 2E 6A 70 67 5F 10 18 68 74 74 70 73 3A |480.jpg_..https:| 00000040 2F 2F 62 6C 6F 67 2E 6D 61 6A 69 64 2E 69 6E 66 |//blog.majid.inf| 00000050 6F 2F 08 0B 37 00 00 00 00 00 00 01 01 00 00 00 |o/..7...........| 00000060 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 52 |....R| 00000075 com.apple.quarantine: 0081;5c8aa4ab;Google Chrome Canary;B718AF12-557C-47AD-840A-0CA98281F256