Correct. https://wicg.github.io/cors-rfc1918/#dns-rebinding describes this reasoning.