SSRF: Spot the Sneaky Localhost

A "fetch this URL for me" feature can be tricked into hitting internal services (SSRF). Attackers hide 127.0.0.1 as 2130706433, 0x7f.1, or 0177.0.0.1. The first line is T; each next line is a host. Lowercase it and drop one trailing ., then:

• localhost or anything ending in .localhost → BLOCK.
• If it parses as IPv4 the way C's inet_aton does, BLOCK when it's in 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12 or 192.168.0.0/16, else ALLOW.
• Anything else is a normal hostname → ALLOW.

inet_aton rules: 1–4 parts split by .; each part is hex (0x…), octal (leading 0), or decimal. With fewer than 4 parts, the last part fills all the remaining bytes (a.b = a, then b as 24 bits; a.b.c = a, b, then c as 16 bits; a single number is all 32 bits). Every part but the last must be ≤ 255 and the last must fit its bytes; otherwise it isn't an IP.