Comment by davidshepherd7

Yeah I think this is correct with the edit.

I guess this is mostly relevant for software that runs on shared infra, sends requests to a url provided by an attacker (e.g. webhooks), and uses a SOCKS5 proxy?