Abstract Geolocation cloaking is a process in which varying and customised web content is delivered to visiting users based on the geographical information derived from the users’ system and network variables. Geolocation cloaking allows a malicious web site to: 1) Increase the success rate of an attacks by targeting a specific population using sociocultural attributes of the visiting user and, perform targeted social engineering attacks. 2) Deliver benign content to requesting users (or detection systems) who do not reside in the geographical location specified by the attacker and, subsequently limit exposure and bypass detection entirely regardless of the detection engine utilised. In this paper we provide an overview of the range of geolocation detection techniques which could potentially be used to estimate the location of a visiting user and perform geolocation cloaking attacks. We discuss these systems in terms of their operation and feasibility to be utilised by a malicious web site.

中文翻译：

---

他们如何找到我们？恶意网站地理位置跟踪技术研究

摘要 Geolocation cloaking 是根据来自用户系统和网络变量的地理信息向访问用户提供不同和定制的 Web 内容的过程。Geolocation cloaking 允许恶意网站： 1) 通过使用访问用户的社会文化属性针对特定人群来提高攻击的成功率，并执行有针对性的社会工程攻击。2) 向不居住在攻击者指定的地理位置的请求用户（或检测系统）提供良性内容，随后完全限制暴露和绕过检测，而不管使用的检测引擎如何。在本文中，我们概述了地理定位检测技术的范围，这些技术可能用于估计访问用户的位置并执行地理定位伪装攻击。我们讨论这些系统的操作和被恶意网站利用的可行性。