You will not win against SSRF using a blocklist of names. You need a comprehensive solution that is designed for this and will check the end address after redirections, DNS resolutions, ... have been applied in whatever library you use for HTTP. An example is advocate for Python https://github.com/JordanMilne/Advocate

http://[::1] still works btw

Just fixed. Thanks.

https://2130706433:443/ https://0177.0.0.01:443/

Can someone educate me on why these 2 links resolve to localhost?

I think the first is the 32 bit int version of 127.0.0.1, and 0177 is the octal representation of 127.

Along those lines, you can also use hex https://0x7f.0.0.0x01:443/