WebGeoInfer: Passive Geolocation Framework

Updated 8 July 2026

WebGeoInfer is a passive geolocation inference framework that detects geographic leakage from administrator-customized text on remote management pages.
It clusters similar DOM trees to extract differential text, overcoming heterogeneity in page layouts and unstructured geographic clues.
The multi-stage pipeline—combining keyword matching, search engine augmentation, LLM reasoning, and geospatial databases—achieves high accuracy in location inference.

Searching arXiv for the cited WebGeoInfer paper and closely related geolocation inference work. WebGeoInfer is a passive geolocation inference framework for publicly exposed remote management devices whose web interfaces inadvertently reveal location hints. It addresses a specific cybersecurity problem: administrator-customized text on management pages may disclose building names, city names, abbreviations, business names, road fragments, or related clues, yet those clues are typically embedded in unstructured formats, varying styles, and incomplete geographical details. WebGeoInfer therefore avoids rigid page-template assumptions and instead uses a structure-free pipeline that clusters similar pages, extracts their differential text, and then applies multi-stage information enhancement through search engines, LLMs, and geospatial databases until a place name or coordinate can be inferred (Yang et al., 16 Aug 2025).

1. Problem setting and threat model

WebGeoInfer is designed for remote management devices that are publicly reachable on the Internet and expose web interfaces intended for administration and monitoring. The paper frames these pages as a source of sensitive geographic leakage: exposed configuration text can reveal where high-value assets are deployed, which in turn supports reconnaissance, targeted attacks, incident-response planning, and regulatory risk assessment (Yang et al., 16 Aug 2025).

The threat model is explicitly passive. WebGeoInfer does not probe devices with packets or otherwise alter network state; it scans publicly accessible pages and infers locations from already exposed content. This distinguishes it from active geolocation methods that depend on landmarks, are sensitive to network noise, and are often blocked by firewalls. The paper argues that such active methods are a poor fit for this domain, and also notes that there is no large-scale landmark corpus for remote-management-device interfaces (Yang et al., 16 Aug 2025).

The central methodological difficulty is heterogeneity. Device vendors implement widely different page layouts, HTML structures, and presentation styles, while administrator-entered clues are often sparse, abbreviated, or only indirectly geographic. Template-driven XPath-style extraction and straightforward named-entity recognition are therefore brittle in this setting. WebGeoInfer’s “structure-free” design is meant to bypass these structural limitations by comparing similar pages rather than relying on a predefined schema (Yang et al., 16 Aug 2025).

2. Structure-free differential extraction from device pages

The framework begins with large-scale collection and preprocessing. Using the Censys corpus and searching for public-facing endpoints labeled “SCADA,” the study collects 205,028 IP-port combinations and retains 89,477 HTML pages after filtering out pages with too little usable content. For each page, the system captures the raw HTML source, screenshots for annotation and inspection, and DOM trees extracted using tools such as BeautifulSoup and lxml (Yang et al., 16 Aug 2025).

The first inferential stage is clustering by structural similarity. For each page $p_i$ , WebGeoInfer extracts the DOM tree $T_i$ , serializes it into a string $S_i$ , and computes a 128-bit Nilsimsa hash $h_i$ . Pairwise similarity is then defined as

$\text{sim}(h_i,h_j) = \frac{128 - d(h_i,h_j)}{128}$

where $d(\cdot,\cdot)$ is the Hamming distance. The clustering procedure initializes singleton clusters, computes pairwise similarities, hierarchically merges clusters whose average similarity exceeds a threshold $\theta$ , and stops when no pair meets the threshold. The default threshold is tuned experimentally to $\theta = 40$ , which yields a peak V-measure of 0.940581. At that setting, the system forms 83 clusters; 52 clusters of size at least 2 align closely with 54 manually identified reference page classes, while 32 singleton clusters are treated as noise (Yang et al., 16 Aug 2025).

Within each cluster, WebGeoInfer performs differential text extraction by aligning nodes across pages using subtree isomorphism. The procedure parses each page into a DOM tree, identifies isomorphic subtrees across pages in the cluster, forms aligned node groups $G = \{g_1,\ldots,g_r\}$ , extracts text from the aligned nodes, normalizes it, and records text as differential whenever aligned nodes differ across pages. The resulting set $\Delta$ is the candidate pool of location-bearing text (Yang et al., 16 Aug 2025).

This design is significant because most content in a device-family cluster is invariant manufacturer-default material, whereas location clues are disproportionately likely to occur in administrator-customized fields. WebGeoInfer thus infers which text is semantically interesting by contrastive analysis over similar pages rather than by manually encoded HTML knowledge. That is the operational meaning of “structure-free” in this framework (Yang et al., 16 Aug 2025).

3. Multi-stage information enhancement and geographic inference

Differential text alone is often too fragmentary to geolocate directly, so WebGeoInfer applies a four-stage information-enhancement pipeline. The stages are cumulative: easy cases are resolved deterministically, while harder cases receive progressively richer contextualization and disambiguation (Yang et al., 16 Aug 2025).

Stage	Mechanism	Role
1	Deterministic keyword matching	Fast identification of strong geographic clues
2	Search engine augmentation	Semantic expansion of sparse fragments
3	Multi-model collaborative inference with LLMs	Extraction, verification, and ambiguity resolution
4	Database-assisted disambiguation	Region-constrained candidate selection

The first stage uses 65 geographic keywords adapted from standards such as ISO 19112. The categories include roads, venues and businesses, administrative and community places, transportation venues, special types, administrative divisions, and country and continent levels. If a differential text segment contains such keywords, it is treated as a strong geographic clue, reducing downstream computation for easy cases (Yang et al., 16 Aug 2025).

If deterministic matching fails, the second stage submits the fragment to a search engine, primarily Bing, controlled via Selenium + ChromeDriver. The paper describes this as semantic expansion: abbreviations, building nicknames, and partial company names may be uninterpretable in isolation but become informative once attached to web snippets, official names, or organization-level context returned by search (Yang et al., 16 Aug 2025).

The third stage uses multiple LLMs for collaborative inference. The evaluated models include Mistral-7B, GLM4-9B, Gemma2-9B, LLaMA3.1-8B, ChatGPT-4o, and Claude 3.7. Prompting is organized around entity recognition, contextual verification, and ambiguity-resolution tasks. Outputs are merged with a weighted ensemble,

$T_i$ 0

where $T_i$ 1 is the final geographic inference, $T_i$ 2 is the candidate set, $T_i$ 3 is the weight for model $T_i$ 4, and $T_i$ 5 is model $T_i$ 6’s confidence in candidate $T_i$ 7. Weights are assigned according to model performance on a gold-standard sample (Yang et al., 16 Aug 2025).

The fourth stage resolves residual ambiguity with IP geolocation databases—IP2Location, IPinfo, MaxMind, and IPIP. WebGeoInfer applies majority voting and imposes region constraints from the device IP address, typically requiring consistency at least at the city or provincial level. This is particularly important for ambiguous street names or city names that recur across countries (Yang et al., 16 Aug 2025).

The coordinate-extraction logic is therefore inferential rather than literal. The framework does not primarily “read latitude/longitude from a page”; it finds differential text, identifies direct indicators when possible, enriches incomplete fragments through search, asks LLMs to infer likely places from the enriched evidence, resolves ambiguities with geospatial databases and IP constraints, and then maps the resulting place names to coordinates via online map or geolocation services (Yang et al., 16 Aug 2025).

4. Experimental design and reported performance

The empirical evaluation uses two annotated resources. For clustering, the study builds a tuning dataset from 54 manually identified page classes and 10,709 structurally similar pages. For end-to-end geolocation assessment, it constructs a gold standard dataset of 1,408 entries with human agreement from multiple annotators. The main baselines are Whois-based geolocation, reverse DNS analysis, and ProbeGeo’s NER-based web extraction (Yang et al., 16 Aug 2025).

The headline outcome is that WebGeoInfer inferred locations for 5,435 devices across 94 countries, 2,056 cities, and 336 autonomous system domains. The reported overall accuracies are 96.96\% at country level, 88.05\% at city level, and 79.70\% at street level. Coverage is also reported as 99.71\% at country level, 99.71\% at city level, and 98.40\% at street level (Yang et al., 16 Aug 2025).

The baseline comparison is domain-specific and important. Whois achieves reasonable country-level coverage but poor accuracy because registration addresses often diverge from actual deployment locations. Reverse DNS contains limited usable geographic information. ProbeGeo’s NER-based approach performs poorly on these highly customized pages, particularly at finer granularity. The paper’s comparison table states that WebGeoInfer substantially outperforms these baselines in both coverage and accuracy across all geographic levels (Yang et al., 16 Aug 2025).

Model-level analysis shows that ChatGPT-4o and Claude 3.7 are the strongest individual models, with ChatGPT-4o performing particularly well at street-level extraction, while LLaMA 3.1 is the best offline model. The ensemble outperforms every individual model, especially at street level. The ablation results are equally central: adding search engine augmentation improves country-level accuracy by 34.31\%–47.79\% and city-level accuracy by up to 49.26\%, while replacing the LLM ensemble with NER reduces performance markedly, especially at street level (Yang et al., 16 Aug 2025).

These results indicate that WebGeoInfer’s gains do not come from any single component alone. They emerge from the combination of cluster-based contrastive extraction, retrieval-style semantic expansion, LLM reasoning, and external geospatial constraints.

5. Position within geolocation and web-based inference research

WebGeoInfer belongs to a broader family of geolocation inference systems, but its input modality and inference substrate are unusual. Whereas GeoWINE takes a single query image and runs a five-module pipeline—image geolocation estimation, Wikidata geospatial retrieval, visual similarity ranking, news retrieval from EventRegistry, and event retrieval from OEKG—WebGeoInfer operates over exposed management-page content rather than photographs or panoramas (Tahmasebzadeh et al., 2021). The difference is not merely engineering: GeoWINE uses inferred coordinates as a semantic anchor for multimodal retrieval, while WebGeoInfer first has to recover any usable geographic anchor from customized web text.

The contrast is equally strong with recent reasoning-oriented visual geolocalizers. GeoReasoner uses a large vision-LLM fine-tuned with locatability-filtered street-view data and reasoning supervision from GeoGuessr and Tuxun (Li et al., 2024). GRE Suite frames geo-localization as a reasoning problem with a supervised-and-reinforcement-trained VLM, the GRE30K reasoning dataset, and GREval-Bench for joint localization and chain-of-thought evaluation (Wang et al., 24 May 2025). WanderBench and GeoAoT move further toward embodied geolocation by allowing rotation and movement through navigation graphs of panoramas (Zheng et al., 11 Mar 2026). GeoSearch extends worldwide image geolocation with web-scale reverse image search, web-page evidence extraction, and a two-layer filtering mechanism based on image matching and confidence gating (Le-Duc et al., 28 Apr 2026). All of these systems treat the core evidence as visual; WebGeoInfer instead treats page-difference text as the primary evidence source.

At the textual end, GeoSense-AI is closer in spirit, because it infers locations from crisis microblogs without relying on sparse geotags. Its pipeline combines statistical hashtag segmentation, POS-driven proper-noun detection, dependency parsing around disaster lexicons, lightweight NER, and gazetteer grounding (Sapru, 20 Dec 2025). WebGeoInfer shares the emphasis on staged extraction plus grounding, but its inputs are DOM-structured management pages rather than short informal posts.

The framework also intersects with web-scale spatial reasoning infrastructure. Geo-L focuses on discovering RDF spatial links via DE+9IM topological relations over SPARQL-defined datasets, caching, invalid-geometry filtering, and PostGIS-backed spatial joins (Zinke-Wehlmann et al., 2019). Geometric Feature Enhanced Knowledge Graph Embedding and Spatial Reasoning injects topology, direction, and distance into HAKE-based GeoKG embeddings to improve link prediction and spatial relation inference (Hu et al., 2024). These systems do not geolocate exposed devices, but they define neighboring layers of the same research space: extracting geospatial facts from the web, disambiguating them, and structuring them for downstream reasoning.

6. Limitations, misconceptions, and cybersecurity implications

The paper explicitly notes several limitations. WebGeoInfer only works when a page exposes some geographic clue; if no location hint exists, there is nothing to infer. It depends on search engine results, making it partly dependent on external retrieval behavior. Multi-language and regional address formats remain difficult. Online LLM inference is costly at scale, and some pages are protected by authentication and therefore do not expose enough content for analysis (Yang et al., 16 Aug 2025).

These limitations clarify several common misconceptions. WebGeoInfer is not an active geolocation system, not a landmark-based image localizer, and not a structure-dependent parser of fixed HTML fields. Its reported accuracies are therefore not generic claims about arbitrary web pages or arbitrary devices; they apply to a specific evaluation setting involving exposed management pages with recoverable clues (Yang et al., 16 Aug 2025).

The cybersecurity implications are direct. The paper connects geolocation leakage to targeted reconnaissance, asset inventory, incident response, regulation and compliance, and exposure reduction. It also reports concentration patterns: the United States dominates the geographic distribution, the top two countries hold about 80\% of devices, many devices are concentrated in a small number of ASes, and about 38.6\% of the devices use the Niagara Web Launcher component (Yang et al., 16 Aug 2025). This suggests that location leakage is not uniformly distributed across the exposed-device ecosystem.

The mitigation recommendations are correspondingly multi-actor. ISPs are advised to improve compliance and privacy oversight. Manufacturers are advised to design safer defaults and reduce unnecessary exposure. Administrators are advised to avoid entering sensitive location details into public management pages and to strengthen access control (Yang et al., 16 Aug 2025). In that sense, WebGeoInfer is not only a geolocation framework but also an instrument for exposure auditing: it demonstrates that publicly reachable device interfaces can leak enough contextual detail to recover street-level locations at scale.