Scan the surrounding subnet for http hosts using iframes and timeouts.

scansubnet.js

var subnet = "http://192.168.178."
var timeout = 4000;

var TIMEOUT = "timeout";
var ERROR = "error";
var LOADED = "loaded";

function request(url, wait) {
	return new Promise((resolve, reject) => {
		setTimeout(function () {
			let resolved = false;
			const start = new Date().getTime(); 
			const e = document.createElement('iframe');
			e.src = url;
			e.sandbox= "";
			e.style.display = 'none';
			document.body.appendChild(e);
			
			let timeoutTimer;
			function r(type, obj) {
				const time = new Date().getTime() - start
				if (resolved) { return; }
				resolved = true;
				clearTimeout(timeoutTimer);
				response = {
					type: type, 
					time: time, 
					url: url, 
					obj: obj, 
					e: e,
					toString: ()=>url
				};	
				e.parentNode.removeChild(e);
				//console.log(response);
				resolve(response)
			}
			
			timeoutTimer = setTimeout(() => {
				r(TIMEOUT, {});
			}, timeout);

			e.addEventListener('load', (obj) => {
				r(LOADED, obj);
			});
			e.addEventListener('error', (obj) => {
				r(ERROR, obj);
			});
		}, wait);
	});
}

function getAllHTTPServersForSubnet(custom_subnet) {
	if (!custom_subnet) { custom_subnet = subnet; }
	let httpRequests = [];
	for (let i = 0; i < 256; i++) {
		httpRequests.push(request(custom_subnet + i, i * 20));
	}
	return Promise.all(httpRequests).then((els)=>Promise.resolve(els.filter((el)=>el.type === LOADED)));	
}

getAllHTTPServersForSubnet().then(console.log)