Interesting, can you share which kind of websites you noticed doing this?
That's what I was trying to get at: Are any websites using this legitimately to communicate with local applications? If so, isn't that a pretty big fingerprinting and attack vector (how are websites authenticating themselves to these local applications and vice versa)?
Edit: Also any local network equipment probably uses local ips a lot, they often have web UIs that have legitimate use cases for this.
Sure, but that trust is about me, an owner of this particular localhost, interacting with it, not trust some.website.on.web to have an unchecked communication with it.