Exploit extended file attributes to figure out where some downloads came from.

kMDItemWhereFroms.sh

#!/usr/bin/env bash
#

for file in "$@"; do
  attr="$(xattr -p com.apple.metadata:kMDItemWhereFroms "$file" 2>/dev/null)"

  url () {
    echo "$attr" | xxd -r -p | plutil -convert xml1 -o - - | \
      ack --output='$1' '(?:<string>)(.+?)</string>' | head -n1
  }

  if [[ -n "$attr" ]]; then
    printf "%-30s %s\n" "$file" "$(url)"
  else
    echo "$file"
  fi
done

# % kMDItemWhereFroms *
# CallRecorder.zip               http://downloads.ecamm.com/CallRecorder.zip
# Chatology_1.0.6.zip            http://cdn.flexibits.com/Chatology_1.0.6.zip
# HyperSwitch.zip
# Isabelle2014.dmg               http://isabelle.in.tum.de/dist/Isabelle2014.dmg
# Powerline Utility.dmg
# Shortcat.zip                   https://files.shortcatapp.com/v0.7.5/Shortcat.zip
# SpeedifyInstaller.dmg
# SuperDuper!.dmg
# TimeLapseAssembler.dmg         http://www.dayofthenewdan.com/TimeLapseAssembler.dmg
# TotalSpaces2-2.2.19.dmg        http://downloads-2.binaryage.com/TotalSpaces2-2.2.19.dmg
# XQuartz-2.7.7.dmg              http://xquartz-dl.macosforge.org/SL/XQuartz-2.7.7.dmg
# anki-2.0.32.dmg
# ideaIC-13.1.6.dmg              http://download-cf.jetbrains.com/idea/ideaIC-13.1.6.dmg
# jdk-7u79-macosx-x64.dmg        http://download.oracle.com/otn-pub/java/jdk/7u79-b15/jdk-7u79-macosx-x64.dmg?AuthParam=1429056837_bfbf37401e271fbab7b2aa62d79d51d6
# jdk-8u45-macosx-x64.dmg        http://download.oracle.com/otn-pub/java/jdk/8u45-b14/jdk-8u45-macosx-x64.dmg?AuthParam=1429056862_fbf5df2d7996b06d0804999da65d88f0
# mscorlib.dll                   https://dl.dropboxusercontent.com/content_link/v0ykmU4KSVjVLV1C6JBKj2JgNWil1o9AUO5661S8oXz7ZbaGMr9lH8Mlt0ic3FZ7?dl=1
# scalive-1.4.zip
# scarab-v1-0-8.zip
# semanticmerge-1.0.74.0.dmg     https://www.semanticmerge.com/users/Download/DownloadInstaller?platform=Mac
# treeviz-1.1.1src.zip
# venture-0.2.tgz