diff --git a/misp_modules/modules/expansion/html_to_markdown.py b/misp_modules/modules/expansion/html_to_markdown.py
index c5637e2e..ea47d58e 100755
--- a/misp_modules/modules/expansion/html_to_markdown.py
+++ b/misp_modules/modules/expansion/html_to_markdown.py
@@ -28,12 +28,17 @@
 
 
 BLOCKED_RANGES = [
+    ipaddress.ip_network("0.0.0.0/8"),
     ipaddress.ip_network("127.0.0.0/8"),
     ipaddress.ip_network("10.0.0.0/8"),
+    ipaddress.ip_network("100.64.0.0/10"),
     ipaddress.ip_network("172.16.0.0/12"),
     ipaddress.ip_network("192.168.0.0/16"),
     ipaddress.ip_network("169.254.0.0/16"),
+    ipaddress.ip_network("::/128"),
     ipaddress.ip_network("::1/128"),
+    ipaddress.ip_network("fc00::/7"),
+    ipaddress.ip_network("fe80::/10"),
 ]
 MAX_REDIRECTS = 10
 
diff --git a/tests/test_html_to_markdown.py b/tests/test_html_to_markdown.py
index 7482d5a9..7816a467 100644
--- a/tests/test_html_to_markdown.py
+++ b/tests/test_html_to_markdown.py
@@ -43,6 +43,29 @@ def test_blocks_hostnames_resolving_to_ipv4_mapped_blocked_addresses(self):
         ):
             self.assertFalse(is_safe_url("http://example.test/"))
 
+    def test_blocks_unspecified_shared_ula_and_link_local_literals(self):
+        blocked_urls = (
+            "http://0.0.0.0/",
+            "http://100.64.0.1/",
+            "http://[::]/",
+            "http://[fc00::1]/",
+            "http://[fd12:3456::1]/",
+            "http://[fe80::1]/",
+            "http://[::ffff:0.0.0.0]/",
+            "http://[::ffff:100.64.0.1]/",
+        )
+
+        for url in blocked_urls:
+            with self.subTest(url=url):
+                self.assertFalse(is_safe_url(url))
+
+    def test_blocks_hostnames_resolving_to_ula_addresses(self):
+        with patch(
+            "misp_modules.modules.expansion.html_to_markdown.socket.getaddrinfo",
+            return_value=[(None, None, None, None, ("fd00::1", 0, 0, 0))],
+        ):
+            self.assertFalse(is_safe_url("http://example.test/"))
+
     def test_rejects_url_without_hostname(self):
         self.assertFalse(is_safe_url("http:///missing-host"))