No host filter here — the server fetches whatever you give it and shows you the body. This is your primary confirmation sink. Try: the internal service http://127.0.0.1:8099/; cloud metadata http://169.254.169.254/latest/meta-data/iam/security-credentials/ then append the role name; the local filesystem file:///etc/hostname or file:///app/secret_internal.txt; an alternate scheme dict://127.0.0.1:8099/; and an allowed host that redirects inward http://links.trusted.lab/redirect?to=http://127.0.0.1:8099/.
Probe internal ports one at a time. Open, closed, and filtered ports respond differently (banner vs instant refusal vs a hang/timeout) — that difference is how blind internal port scanning works. Find the one open service port.