Comment by Cyder

can't the browser download the webpage that contains code to scan 127.0.0.1 then forward the data back to the server? this would also bypass vpn protection.