Sort of. A web page can, in some circumstances, be made to probe - e.g. if you have an <img src="http://192.168.1.0"/> http://192.168.1.0"/> it will likely do

Sort of. A web page can, in some circumstances, be made to probe - e.g. if you have an <img src="http://192.168.1.0"/> http://192.168.1.0"/> it will likely do an http connection to that address; whether you can actually use it for exploration depends on a lot of things. There's a class of attacks called "DNS rebinding" that use DNS and named hosts to bypass some browser protections and cross-origin policies (see e.g. [0]) But you still need some form of cooperation - a browser request - which, as [0] points out, can be bought as an ad -- just one more reason for ad blockers. [0] https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://medium.com/@brannondorsey/attacking-private-networks...