Webhook-url-http-3a-2f-2f169.254.169.254-2fmetadata-2fidentity-2foauth2-2ftoken -

If you spend any time in cloud security or penetration testing, you will eventually memorize one IP address: 169.254.169.254.

This is the link-local address (RFC 3927) reserved for cloud metadata services. When an attacker sends you a webhook URL that looks like http://169.254.169.254/metadata/identity/oauth2/token, they aren't trying to send you a friendly notification. They are trying to trick your server into stealing its own cloud identity tokens. If you spend any time in cloud security

Verify whether the application follows redirects or leaks response bodies or headers.

Check if logs capture returned tokens or metadata.

The string http-3A-2F-2F169.254.169.254-2Fmetadata-2Fidentity-2Foauth2-2Ftoken is a URL-encoded version of a standard Azure IMDS path. Verify whether the application follows redirects or leaks

Fully Decoded URL:

http://169.254.169.254/metadata/identity/oauth2/token