One subdomain, many redirect shapes.
/r?u=URL — 302 to URL (http, https, gopher, dict, ldap, file, ftp)/r?u=URL&code=307 — same, chosen status: 301/302/303/307/308/s/307?u=URL — status taken from the path segment/i.png?u=URL — redirect from a path ending in .png (extension-checked sinks)/i/x.png?u=URL — same, arbitrary image filename/px.png — real 1x1 PNG (control: proves the sink accepts this host at all)/m/aws — redirect to a metadata target; names below/g?u=gopher://... — scheme-switch redirect (http validator, gopher fetch)/c?n=2&u=URL — redirect chain of n hops, ending at URL/rel?p=/internal/path — relative Location (proxy-relative bypass)/d?ms=3000&u=URL — delayed redirect (timing oracle)/p — JSON echo: client IP, UA, all headers that arrived/log?k=KEY&n=100 — recent hits as JSONLmetadata names: aws, awsiam, awsuser, awsid, ecs, gcp, gcpacct, azure, azureid, alibaba, do, oracle, loop, envoy, docker, redis