import ipaddress
from urllib.parse import urlsplit


def is_safe_url(
    url: str,
    allowed_domains: list[str] | None = None,
    default_host: str = "",
) -> bool:
    try:
        parts = urlsplit(url)
        if parts.scheme not in ("http", "https"):
            return False

        host = (parts.hostname or "").lower()
        if not host or host in ("localhost", "127.0.0.1", "::1"):
            return False

        try:
            ip = ipaddress.ip_address(host)
            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
                return False
        except ValueError:
            pass

        domains = [d.lower() for d in (allowed_domains or []) if d]
        if not domains and default_host:
            domains = [default_host.lower()]

        if not domains:
            return True

        return any(host == d or host.endswith("." + d) for d in domains)
    except Exception:
        return False