function isInvalidIp({ hostname }) {
  if (runtimeSettings.get("allowAnyIp")) {
    console.log(
      "\x1b[33mURL IP local address restrictions have been disabled by administrator!\x1b[0m"
    );
    return false;
  }

  const IPRegex = new RegExp(
    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/gi
  );

  // Not an IP address at all - passthrough
  if (!IPRegex.test(hostname)) return false;
  const [octetOne, ..._rest] = hostname.split(".");

  // If fails to validate to number - abort and return as invalid.
  if (isNaN(Number(octetOne))) return true;

  // Allow localhost loopback and 0.0.0.0 for scraping convenience
  // for locally hosted services or websites
  if (["127.0.0.1", "0.0.0.0"].includes(hostname)) return false;

  return INVALID_OCTETS.includes(Number(octetOne));
}
If an ip address is passed in the user is attempting to collector some internal service running on internal/private IP.
This is not a security feature and simply just prevents the user from accidentally entering invalid IP addresses.
Can be bypassed via COLLECTOR_ALLOW_ANY_IP environment variable.
@param {URL} param0
@param {URL['hostname']} param0.hostname
@returns {boolean}