Ask HN: Why does the US Visa application website do a port-scan of my network?

#1

Post by mbix77 » Wed, Aug 20, 2025, 6:03 AM UTC

I have recently installed this extension on FF: https://addons.mozilla.org/en-US/firefox/addon/port-authorit... and yesterday I visited this website: https://ceac.state.gov/genniv/ and I got a notification that the website tried to do a port-scan of my private network.

Is this a common thing? I have just recently installed the extension, so I am not sure if there are a lot of other websites who do it.

Since looking into it, I noticed that uBlock Origin already has the default list "Block Outsider Intrusion into LAN" but it wasn't enabled.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#2

Post by Maxious » Wed, Aug 20, 2025, 6:27 AM UTC

Perhaps to avoid people using misconfigured open proxies https://en.wikipedia.org/wiki/Open_proxy

Like a less sophisticated Tor/VPN that is easily detected by port scans

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#3

Post by galaxy_gas » Wed, Aug 20, 2025, 6:29 AM UTC

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them

1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#4

Post by kolla » Wed, Aug 20, 2025, 6:43 AM UTC

My biggest grief with that site is that it's like something from the 90s.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#5

Post by asimovDev » Wed, Aug 20, 2025, 6:46 AM UTC

Embarrassed to say that I wasn't aware of this practice. Are there malicious uses for this beyond fingerprinting?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#6

Post by asimovDev » Wed, Aug 20, 2025, 6:49 AM UTC

asimovDev wrote: post #5

Embarrassed to say that I wasn't aware of this practice. Are there malicious uses for this beyond fingerprinting?

https://files.catbox.moe/g1bejn.png

When I visit the site from Safari on macOS I see this in the console. Are there any particular services that use port 8888 for the website to do this?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#7

Post by vaylian » Wed, Aug 20, 2025, 6:49 AM UTC

> Blocks malicious websites from port-scanning your computer/network

How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#8

Post by est » Wed, Aug 20, 2025, 6:50 AM UTC

vaylian wrote: post #7

> Blocks malicious websites from port-scanning your computer/network How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

but it can hook javascript methods before that scan can happen.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#9

Post by Mashimo » Wed, Aug 20, 2025, 6:52 AM UTC

vaylian wrote: post #7

> Blocks malicious websites from port-scanning your computer/network How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

Judging just from the screenshots, it seems it blocks websites from accessing 127.0.0.1 get requests. Not a port scan to the outside, more of what do you have running on the local machine inside your network.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#10

Post by edarchis » Wed, Aug 20, 2025, 6:54 AM UTC

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.