In the console of the site hh.ru requests to 127.0.0.1 for what?

Question

JavaScript

I noticed the browser hangs on the HH.RU website, went to the console, saw requests to the local host. What are they for?

Requests always start after a request to the address " https://top-fwz1.mail.ru/tracker "

Answer 1

Scans ports to find vulnerabilities and install mailGuard and other viruses.
Details here: https://habrahabr.ru/post/139280/

Answer 2

But the script tries to send such requests to the 80th port

127.0.0.1 - - [17/Mar/2018 23:54:38] code 400, message Bad request syntax ('\x16
\x03\x01\x00R\x01\x00\x00?\x03\x03?\x98ca-\x15X\x7f\x02fh9\x8f\x98iFYa\x86?+A')
127.0.0.1 - - [17/Mar/2018 23:54:38] "▬♥☺ R☺  ?♥♥??ca-§X⌂☻fh9??iFYa??+A" 400 -

Very similar to a hack attempt. This is done by a script called secureportal.v5.js On request, Google found this https://www.group-ib.ru/secure_portal.html

Answer 3

Looks like mailru is scanning your ports. Click on the link there at the end of the line, maybe the code will make it clear what it does.

Answer 4

Checking unwanted software on the client device (which opens ports on the local interface) and protecting the token: collecting data for FingerPrint (digital "fingerprint" of the client - browser).
I.e., it's security hardening and data collection by port scanning... :(

Answer 5

Why does hh.ru make many requests to 127.0.0.1 on different ports?