[Scoundreller]

He’s swedish, so he enters under the Western Hemisphere Travel Initiative which doesn’t require a visa, but usually requires an ESTA.

An ESTA is not a visa (otherwise the US could lose its reciprocal visa-free travel arrangements). The ESTA just walks, talks and quacks like a visa.

[Macha]

Note that their is a distinction. While arguably even the ESTA is too much paperwork compared to what US citizens going the other way under these visa-free agreements face, it's a short form you fill out online that gets automatically approved within 12 hours for 95% of cases. It's when you get denied for this system (and yes, this can be for arbitrary reasons which they won't disclose), that things go wrong. It would not surprise me if the logic went "owns domain haxx + curl is used in hacker tools (and many many more legitimate uses, but some agent doesn't care)", "possible hacker", "put on list that causes ESTA denials".