an IPv4 or IPv6 address literal (no brackets, no port).
true when the address falls in a blocked range and must not be fetched.
IsBlockedIPAddress('169.254.169.254'); // true — cloud metadata endpoint
IsBlockedIPAddress('10.0.0.5'); // true — RFC 1918 private
IsBlockedIPAddress('::ffff:127.0.0.1'); // true — IPv4-mapped loopback
IsBlockedIPAddress('93.184.216.34'); // false — public
IsBlockedIPAddress('not-an-ip'); // true — fail closed
Classifies a single IP address literal as blocked or allowed.
This is the pure, synchronous core of the guard — no DNS, no I/O — exposed for callers that have already resolved an address themselves (a proxy allowlist, a webhook source check, a test). For anything URL-shaped, use AssertPublicUrl, which also handles resolution and the scheme check.
Fails closed: anything
net.isIPdoes not recognize as a v4 or v6 literal is reported as blocked, so a parsing gap can never silently widen what is reachable.