SSRF Localhost Service Probe - ATR-2026-01607 (f971e3e8-29f4-501b-897a-c91c970311c2)
Detects SSRF attempts targeting localhost (127.0.0.1, ::1, 0.0.0.0) and common loopback aliases. Localhost-targeted SSRF probes services running on the agent's host that are bound only to the loopback interface: database admin interfaces (Redis 6379, MongoDB 27017, Elasticsearch 9200), internal API gateways, debug endpoints, or developer tooling. These services typically have no authentication because they assume only local access. Also catches IPv6 loopback (::1) and decimal/hex-encoded variants.