Physical Address Detection Scanner

Web applications are internet-facing software systems used by organizations of all sizes to deliver services, publish information, and interact with customers. They are built on a wide range of technologies including HTML, JavaScript, and server-side frameworks, and are accessed through standard web browsers. Organizations deploy web applications for purposes such as e-commerce, customer support, corporate communications, and internal portals. Contact and about pages are commonly included in web applications to provide users with organizational details, including physical location information. These pages are indexed by search engines and routinely crawled by automated tools, making their content widely accessible. Web applications handling sensitive organizational data, including location details, require careful review of what information is publicly surfaced.

Physical address detection refers to the automated identification of postal and location information that is publicly accessible on web pages. This information may be embedded in semantic HTML elements such as the address tag, structured data formats like JSON-LD with PostalAddress types, microdata itemprop attributes, or plain visible text near contact-related keywords. While publishing an address is often intentional and in many jurisdictions legally required, automated harvesting of this data amplifies the associated risk beyond a single page visit. Combined with other open-source intelligence, collected address data can be used to build detailed organizational profiles. The detection is particularly significant when it reveals operational locations such as data centers, executive offices, or addresses that appear in unexpected parts of the page structure. Organizations may be unaware of how broadly their address data is distributed across subpages and structured markup layers.

The scanner fetches the root page of the target asset and attempts rendering via a headless browser (Browserless) before falling back to a plain HTTP request. It then parses anchor tags to identify contact-related subpages using a keyword list that includes terms such as contact, iletisim, hakkimizda, and about-us, visiting up to five of these pages. On each collected HTML document, four independent extraction strategies are applied sequentially. The first strategy matches HTML5 address tags using a regex over the raw markup. The second parses inline JSON-LD script blocks and walks the object graph for nodes typed as PostalAddress. The third scans microdata blocks typed as PostalAddress and collects values from itemprop attributes such as streetAddress, addressLocality, postalCode, and addressCountry. The fourth strips scripts and styles, breaks the remaining text into lines, and scores each against twelve Turkish and generic address indicator patterns, accepting blocks that score two or more matches.

When physical addresses are collected by malicious actors, they can be used as part of social engineering campaigns targeting employees or executives at those locations. Aggregated address data enables adversaries to build detailed OSINT profiles of an organization, mapping offices, data centers, or key personnel to specific geographic coordinates. In targeted attack scenarios, physical location knowledge can facilitate tailored phishing lures that reference familiar local details to increase credibility. For individuals whose home addresses are inadvertently published on a corporate or personal site, the risks extend to physical safety and stalking. Organizations subject to data protection regulations may face compliance violations if contact pages disclose address information beyond what is operationally necessary. Competitors may also exploit harvested location data for business intelligence, facility mapping, or supply chain analysis.