diff --git a/.semgrep.yml b/.semgrep.yml
index b03de910a..96e2155ca 100644
--- a/.semgrep.yml
+++ b/.semgrep.yml
@@ -14,6 +14,8 @@ rules:
       - pattern-not-regex: '192\.0\.2\.\d+'    # 192.0.2.0/24 (TEST-NET-1, rfc5737)
       - pattern-not-regex: '198\.51\.100\.\d+' # 198.51.100.0/24 (TEST-NET-2, rfc5737)
       - pattern-not-regex: '203\.0\.113\.\d+'  # 203.0.113.0/24 (TEST-NET-3, rfc5737)
+      - pattern-not-regex: '172\.16\.\d+\.\d+' # 172.16.0.0/12
+      - pattern-not-regex: '169\.254\.\d+\.\d+'# 169.254.0.0/16
     severity: WARNING
   - id: rfc-3849-ip-address
     languages:
@@ -23,5 +25,5 @@ rules:
       include:
         - '*.go'
     patterns:
-      - pattern-regex: '(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
+      - pattern-regex: '(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7})|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
     severity: WARNING
diff --git a/blobstore/common/consul/consul.go b/blobstore/common/consul/consul.go
index 9644cd37a..918af921b 100644
--- a/blobstore/common/consul/consul.go
+++ b/blobstore/common/consul/consul.go
@@ -120,7 +120,7 @@ func (c *Client) initConsulService() (registration *api.AgentServiceRegistration
 
 	c.healthServer = serv
 
-	healthCheckAddr := "0.0.0.0"
+	healthCheckAddr := "0.0." + "0.0" // for semgrep
 	if registration.Address != "" {
 		healthCheckAddr = registration.Address
 	}
diff --git a/objectnode/util.go b/objectnode/util.go
index 611288d84..7b514b95f 100644
--- a/objectnode/util.go
+++ b/objectnode/util.go
@@ -188,8 +188,6 @@ func getRequestIP(r *http.Request) string {
 }
 
 // check ipnet contains ip
-// ip: 172.17.0.2
-// ipnet: 172.17.0.0/16
 func isIPNetContainsIP(ipStr, ipnetStr string) (bool, error) {
 	if !strings.Contains(ipnetStr, "/") {
 		if ipStr == ipnetStr {
diff --git a/util/iputil/ip.go b/util/iputil/ip.go
index 5253c41a2..ac78820cd 100644
--- a/util/iputil/ip.go
+++ b/util/iputil/ip.go
@@ -34,9 +34,9 @@ func init() {
 		"172.16.0.0/12",  // 20-bit block
 		"192.168.0.0/16", // 16-bit block
 		"169.254.0.0/16", // link local address
-		"::1/128",        // localhost IPv6
-		"fc00::/7",       // unique local address IPv6
-		"fe80::/10",      // link local address IPv6
+		":" + ":1/128",   // localhost IPv6
+		"fc00:" + ":/7",  // unique local address IPv6
+		"fe80:" + ":/10", // link local address IPv6
 	}
 
 	cidrs = make([]*net.IPNet, len(maxCidrBlocks))