Some time ago, I made something using a similar technique to redirect to router configuration pages. Used WebRTC to get local IPv4, then spawned a worker and timed it, if it came back fast, I assumed it was there, and redirected the user, otherwise I tried a different common "router" address. I was unaware of dns rebinding at the time.