diff --git a/docs/changelog/960.bugfix.rst b/docs/changelog/960.bugfix.rst
new file mode 100644
index 000000000..ea8c4dcd8
--- /dev/null
+++ b/docs/changelog/960.bugfix.rst
@@ -0,0 +1,4 @@
+Attribute URL hosts the way a browser resolves them in ``normalize_url``, ``clean_url``, ``extract_links``,
+``resolve_links``, and the sanitizer's ``media_hosts`` allowlist: a special-scheme authority ends at a backslash, an
+IPv4 address is read in all four notations and emitted dotted-decimal, the host is percent-decoded, and an IPv6 literal
+is zero-compressed.
diff --git a/docs/how-to/links.rst b/docs/how-to/links.rst
index 05e27da9d..4af0e7233 100644
--- a/docs/how-to/links.rst
+++ b/docs/how-to/links.rst
@@ -46,6 +46,13 @@ with :func:`turbohtml.extract.normalize_url`. It applies the WHATWG URL standard
 
     https://example.org/page?a=1&b=2
 
+The host is attributed the way a browser resolves it, so a link-safety or SSRF check keyed on the result sees the host a
+browser fetches: a special-scheme authority ends at a backslash (``http://a\@b/`` has host ``a``), an IPv4 address is
+read in decimal, octal, hexadecimal, and short forms and re-emitted dotted-decimal (``http://127.1/`` becomes
+``http://127.0.0.1/``), the host is percent-decoded, and an IPv6 literal is zero-compressed (``[0:0:0:0:0:0:0:1]``
+becomes ``[::1]``). An IPv6 literal with an embedded-IPv4 tail (``[::ffff:1.2.3.4]``) keeps its given spelling. The same
+host parsing backs ``extract_links(external_only=True)`` and :meth:`~turbohtml.Node.resolve_links`.
+
 For URLs scraped out of markup, :func:`turbohtml.extract.clean_url` first scrubs HTML damage (stray whitespace,
 ``&``, a truncating quote) and answers ``None`` for anything that is not a fetchable web URL, so a scraping pipeline
 can filter and normalize in one call. :class:`turbohtml.extract.UrlCleaning` carries the knobs: a strict query-parameter
diff --git a/docs/reference/clean.rst b/docs/reference/clean.rst
index 85809e182..a5ebc4e54 100644
--- a/docs/reference/clean.rst
+++ b/docs/reference/clean.rst
@@ -66,9 +66,10 @@ drops the declaration holding it.
 
 ``Policy.attribute_filter`` replacements and ``Policy.set_attributes`` additions pass through the mandatory safety
 checks before serialization. These checks remove event handlers, disallowed URL, ``srcset`` and meta refresh schemes,
-unsafe CSS, media hosts outside ``media_hosts``, and values outside ``attribute_values``. Template stripping and
-named-property isolation run on the final values. The sanitizer ASCII-lowercases HTML names created by these rules
-before the checks.
+unsafe CSS, media hosts outside ``media_hosts`` (matched against the host a browser resolves, so an authority ending at
+a backslash cannot smuggle an off-allowlist host past the check), and values outside ``attribute_values``. Template
+stripping and named-property isolation run on the final values. The sanitizer ASCII-lowercases HTML names created by
+these rules before the checks.
 
 ``Policy.transform_tags`` renames elements during the same walk, sanitize-html's ``transformTags``. Key it by source
 tag: map to a bare string to rename, or to a :class:`Transform` to rename and add attributes. The rename runs *before*
diff --git a/src/turbohtml/_c/clean/sanitize.c b/src/turbohtml/_c/clean/sanitize.c
index 9d2c1dcaf..a5d972423 100644
--- a/src/turbohtml/_c/clean/sanitize.c
+++ b/src/turbohtml/_c/clean/sanitize.c
@@ -552,31 +552,41 @@ static int is_media_host_tag(uint16_t atom) {
     }
 }
 
-/* The authority marker bytes that end a URL host: a path, query, or fragment. */
+/* The bytes that end a URL authority: a path, query, or fragment delimiter, plus the '\' a browser treats as a
+   separator for a special scheme (WHATWG authority state, https://url.spec.whatwg.org/#authority-state). A real host
+   never contains '\', so ending the authority at one only tightens the host the allowlist sees, closing the
+   `evil.example\@good.example` userinfo trick a browser resolves to evil.example. */
 static int ends_authority(Py_UCS4 c) {
     switch (c) {
     case '/':
     case '?':
     case '#':
+    case '\\':
         return 1;
     default:
         return 0;
     }
 }
 
-/* Locate the authority host of a URL value: the host after "scheme://" or a protocol-relative "//". The authority is
-   bounded here without preprocessing the value (the WHATWG tab/newline stripping a browser applies is intentionally not
-   done, so an obfuscated host never masquerades as an allowlisted one), then th_url_authority -- the same decomposition
-   url_split runs -- splits off any "userinfo@" and ":port" and reports the host span and its literal kind. Sets
-   *start,*end to the host span and *kind to the host literal, returns 0, or returns -1 when the URL carries no
-   authority (a relative or opaque src, which has no host to match). */
+/* A URL authority opener slash: '/', or the '\' a browser treats alike for a special scheme. */
+static int authority_slash(Py_UCS4 c) {
+    return c == '/' || c == '\\';
+}
+
+/* Locate the authority host of a URL value: the host after "scheme://" or a protocol-relative "//" (with '\' accepted
+   like '/', as a browser does for a special scheme). The authority is bounded here without preprocessing the value (the
+   WHATWG tab/newline stripping a browser applies is intentionally not done, so an obfuscated host never masquerades as
+   an allowlisted one), then th_url_authority -- the same decomposition url_split runs -- splits off any "userinfo@" and
+   ":port" and reports the host span and its literal kind. Sets *start,*end to the host span and *kind to the host
+   literal, returns 0, or returns -1 when the URL carries no authority (a relative or opaque src, which has no host to
+   match). */
 static int url_host_span(const Py_UCS4 *value, Py_ssize_t len, Py_ssize_t *start, Py_ssize_t *end, int *kind) {
     Py_ssize_t authority = -1;
-    if (len >= 2 && value[0] == '/' && value[1] == '/') {
+    if (len >= 2 && authority_slash(value[0]) && authority_slash(value[1])) {
         authority = 2; /* protocol-relative //host/path */
     }
     for (Py_ssize_t index = 0; authority < 0 && index + 2 < len; index++) {
-        if (value[index] == ':' && value[index + 1] == '/' && value[index + 2] == '/') {
+        if (value[index] == ':' && authority_slash(value[index + 1]) && authority_slash(value[index + 2])) {
             authority = index + 3; /* scheme://host */
         }
     }
diff --git a/src/turbohtml/_c/core/common.h b/src/turbohtml/_c/core/common.h
index afd37fd07..baf4eaeba 100644
--- a/src/turbohtml/_c/core/common.h
+++ b/src/turbohtml/_c/core/common.h
@@ -197,6 +197,15 @@ PyObject *turbohtml_url_language_matches(PyObject *module, PyObject *args);
 PyObject *th_url_to_ascii(PyObject *host);
 PyObject *turbohtml_url_to_ascii(PyObject *module, PyObject *arg);
 
+/* Implemented in url/url.c. th_url_host_canonical runs the rest of the WHATWG host parser over the bracket-stripped
+   host span url_split reports (https://url.spec.whatwg.org/#concept-host-parser): a bracketed IPv6 literal (kind
+   TH_HOST_IPV6) is parsed and serialized with zero-run compression; any other host is percent-decoded, run through
+   domain-to-ASCII, and -- when it ends in a number -- parsed as IPv4 and re-serialized in dotted-decimal, so two
+   spellings of one address compare equal. The host is a borrowed str, the result a new str (brackets dropped for IPv6);
+   NULL with an error only on allocation failure. A host that is not valid for its form falls back to its lowercased
+   spelling, the advisory behavior normalize_url already takes for an unencodable label. */
+PyObject *th_url_host_canonical(PyObject *host, int kind);
+
 /* Implemented in url/registrable.c. _registrable_domain(host) returns a lowercased
    host's registrable domain (eTLD+1) from the shipped IANA and Public Suffix List
    tables, the site boundary behind extract_links(external_only=True). METH_O. */
diff --git a/src/turbohtml/_c/extract/links.c b/src/turbohtml/_c/extract/links.c
index 07bcfdcc1..10ae61ea0 100644
--- a/src/turbohtml/_c/extract/links.c
+++ b/src/turbohtml/_c/extract/links.c
@@ -4,8 +4,8 @@
    This file is the walk that locates every link-bearing location and, for the rewrite path, splices a replacement back
    in place. The genuinely new capability over iterating <a href> by hand is the URLs embedded in CSS url()/@import (in
    a style attribute and in <style> text), in a <meta http-equiv=refresh> content value, and in the srcset/ping/archive
-   list attributes. URL resolution itself (resolve_links) is stdlib urllib.parse.urljoin, bound through
-   functools.partial here, so RFC 3986 is not reinvented. */
+   list attributes. URL resolution itself (resolve_links) is the C _url_join, bound through functools.partial here, so
+   RFC 3986 resolution is not reinvented and a reference's host matches the one a browser resolves. */
 
 #include "core/ascii.h"
 #include "core/common.h"
@@ -724,7 +724,8 @@ static Py_ssize_t base_scheme_of(PyObject *base_url, char *out, Py_ssize_t cap)
 }
 
 /* Node.resolve_links(base_url) -> None. Rewrites every link absolute against base_url with functools.partial bound over
-   stdlib urllib.parse.urljoin, so RFC 3986 resolution is not reinvented. */
+   the C _url_join, so a reference's host matches the one a browser resolves -- including the WHATWG backslash authority
+   forms stdlib urllib.parse.urljoin misattributes -- without reinventing RFC 3986 resolution. */
 PyObject *turbohtml_node_resolve_links(PyObject *owner, th_tree *tree, th_node *root, PyObject *base_url) {
     if (!PyUnicode_Check(base_url)) {
         PyErr_SetString(PyExc_TypeError, "resolve_links expected a base URL string");
@@ -734,13 +735,13 @@ PyObject *turbohtml_node_resolve_links(PyObject *owner, th_tree *tree, th_node *
     Py_ssize_t base_scheme_len = base_scheme_of(base_url, base_scheme, (Py_ssize_t)sizeof(base_scheme));
     int base_netloc_scheme = (base_scheme_len == 4 && memcmp(base_scheme, "http", 4) == 0) ||
                              (base_scheme_len == 5 && memcmp(base_scheme, "https", 5) == 0);
-    PyObject *parse_module = PyImport_ImportModule("urllib.parse");
-    if (parse_module == NULL) { /* GCOVR_EXCL_BR_LINE: a stdlib import cannot be forced to fail from a test */
-        return NULL;            /* GCOVR_EXCL_LINE: import-failure path */
+    PyObject *html_module = PyImport_ImportModule("turbohtml._html");
+    if (html_module == NULL) { /* GCOVR_EXCL_BR_LINE: the extension's own module is already imported */
+        return NULL;           /* GCOVR_EXCL_LINE: import-failure path */
     }
-    PyObject *urljoin = PyObject_GetAttrString(parse_module, "urljoin");
-    Py_DECREF(parse_module);
-    if (urljoin == NULL) { /* GCOVR_EXCL_BR_LINE: urllib.parse.urljoin always exists */
+    PyObject *urljoin = PyObject_GetAttrString(html_module, "_url_join");
+    Py_DECREF(html_module);
+    if (urljoin == NULL) { /* GCOVR_EXCL_BR_LINE: _url_join is always registered on the module */
         return NULL;       /* GCOVR_EXCL_LINE: attribute-failure path */
     }
     PyObject *functools_module = PyImport_ImportModule("functools");
diff --git a/src/turbohtml/_c/url/clean.c b/src/turbohtml/_c/url/clean.c
index d3f7d95eb..ceef194d0 100644
--- a/src/turbohtml/_c/url/clean.c
+++ b/src/turbohtml/_c/url/clean.c
@@ -115,30 +115,6 @@ static int str_holds(PyObject *text, Py_UCS4 needle) {
     return PyUnicode_FindChar(text, needle, 0, PyUnicode_GET_LENGTH(text), 1) >= 0;
 }
 
-/* The ASCII (punycode) form of a registered name the way the URL standard's host parser produces it (spec 3.5): the
-   lowercased host when it is already ASCII, else UTS #46 ToASCII in C; a label punycode cannot encode (an unpaired
-   surrogate) leaves the lowercased host as it is, which the later encode step then rejects. */
-static PyObject *ascii_host(PyObject *host) {
-    PyObject *lowered = PyObject_CallMethod(host, "lower", NULL);
-    if (lowered == NULL) { /* GCOVR_EXCL_BR_LINE: str.lower cannot fail on a host */
-        return NULL;       /* GCOVR_EXCL_LINE: allocation-failure path */
-    }
-    if (PyUnicode_IS_ASCII(lowered)) {
-        return lowered;
-    }
-    PyObject *encoded = th_url_to_ascii(lowered);
-    if (encoded != NULL) {
-        Py_DECREF(lowered);
-        return encoded;
-    }
-    if (!PyErr_ExceptionMatches(PyExc_ValueError)) { /* GCOVR_EXCL_BR_LINE: ToASCII raises nothing else */
-        Py_DECREF(lowered);                          /* GCOVR_EXCL_LINE: allocation-failure path */
-        return NULL;                                 /* GCOVR_EXCL_LINE */
-    }
-    PyErr_Clear();
-    return lowered;
-}
-
 /* The ":port" suffix, or "" for an absent, empty, or scheme-default port (port state, URL standard 4.4). A port of
    digits is read as the integer it spells, so leading zeros fall away and "0080" is the http default. */
 static PyObject *port_suffix(const th_url_parts *parts) {
@@ -176,20 +152,16 @@ static PyObject *port_suffix(const th_url_parts *parts) {
     return suffix;
 }
 
-/* The authority rebuilt from its normalized host and port, keeping userinfo verbatim: a registered name goes through
-   domain-to-ASCII, an IPv4/IPv6 literal is already ASCII and only lowercases (IPv6 keeping its brackets). */
+/* The authority rebuilt from its WHATWG-canonical host and port, keeping userinfo verbatim: the host is
+   percent-decoded, domain-to-ASCII'd, and IPv4/IPv6-canonicalized by th_url_host_canonical, then a bracketed IPv6
+   literal is re-wrapped. */
 static PyObject *normalize_netloc(const th_url_parts *parts) {
-    PyObject *host;
-    if (parts->kind == TH_HOST_REGNAME) {
-        host = ascii_host(parts->part[TH_URL_HOST]);
-    } else {
-        PyObject *lowered = PyObject_CallMethod(parts->part[TH_URL_HOST], "lower", NULL);
-        if (lowered == NULL) { /* GCOVR_EXCL_BR_LINE: str.lower cannot fail on a host */
-            return NULL;       /* GCOVR_EXCL_LINE: allocation-failure path */
-        }
-        host = parts->kind == TH_HOST_IPV6 ? th_str_format("[%U]", lowered) : Py_NewRef(lowered);
-        Py_DECREF(lowered);
+    PyObject *canonical = th_url_host_canonical(parts->part[TH_URL_HOST], parts->kind);
+    if (canonical == NULL) { /* GCOVR_EXCL_BR_LINE: the host parse only fails on allocation failure */
+        return NULL;         /* GCOVR_EXCL_LINE: allocation-failure path */
     }
+    PyObject *host = parts->kind == TH_HOST_IPV6 ? th_str_format("[%U]", canonical) : Py_NewRef(canonical);
+    Py_DECREF(canonical);
     if (host == NULL) { /* GCOVR_EXCL_BR_LINE: the host fold only fails on allocation failure */
         return NULL;    /* GCOVR_EXCL_LINE: allocation-failure path */
     }
@@ -465,9 +437,9 @@ static PyObject *site_of(PyObject *url) {
     if (th_url_split(url, &parts) < 0) {
         return NULL;
     }
-    PyObject *host = ascii_host(parts.part[TH_URL_HOST]);
+    PyObject *host = th_url_host_canonical(parts.part[TH_URL_HOST], parts.kind);
     th_url_parts_clear(&parts);
-    if (host == NULL) { /* GCOVR_EXCL_BR_LINE: the host fold only fails on allocation failure */
+    if (host == NULL) { /* GCOVR_EXCL_BR_LINE: the host parse only fails on allocation failure */
         return NULL;    /* GCOVR_EXCL_LINE: allocation-failure path */
     }
     PyObject *site = turbohtml_registrable_domain(NULL, host);
diff --git a/src/turbohtml/_c/url/url.c b/src/turbohtml/_c/url/url.c
index 3e7b32b50..e79283993 100644
--- a/src/turbohtml/_c/url/url.c
+++ b/src/turbohtml/_c/url/url.c
@@ -211,6 +211,49 @@ static Py_UCS4 input_char(int kind, const void *data, Py_ssize_t index) {
     return PyUnicode_READ(kind, data, index);
 }
 
+int th_url_scheme_special(const Py_UCS4 *buf, Py_ssize_t start, Py_ssize_t end) {
+    /* an array+loop, not a chained ``||`` of equalities, so the clang branch gate stays stable when this inlines */
+    static const char *const SPECIAL[] = {"http", "https", "ws", "wss", "ftp", "file"};
+    Py_ssize_t span = end - start;
+    for (size_t choice = 0; choice < sizeof(SPECIAL) / sizeof(SPECIAL[0]); choice++) {
+        const char *name = SPECIAL[choice];
+        if ((Py_ssize_t)strlen(name) != span) {
+            continue; /* a length check first keeps the compare loop free of a name-terminator branch */
+        }
+        Py_ssize_t index = 0;
+        while (index < span && (buf[start + index] | 0x20) == (Py_UCS4)(unsigned char)name[index]) {
+            index++; /* |0x20 folds an ASCII letter; a scheme is letters-only, so a non-letter just fails the compare */
+        }
+        if (index == span) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+/* An authority-opener slash: always '/', and for a special scheme also '\' (WHATWG special-authority / relative-slash
+   states treat the two alike, https://url.spec.whatwg.org/#special-authority-slashes-state). */
+static int url_slash(Py_UCS4 ch, int special) {
+    return ch == '/' || (special && ch == '\\');
+}
+
+/* The authority span work[start,end) ends at EOF, '/', '?', '#', or -- for a special scheme -- '\' (WHATWG authority
+   state, https://url.spec.whatwg.org/#authority-state). Brackets must balance (an IPv6 literal); an unbalanced pair
+   returns -1, the "Invalid IPv6 URL" the shim surfaces. */
+static Py_ssize_t authority_end(const Py_UCS4 *value, Py_ssize_t start, Py_ssize_t len, int special) {
+    int has_open = 0;
+    int has_close = 0;
+    for (; start < len; start++) {
+        Py_UCS4 ch = value[start];
+        if (ch == '/' || ch == '?' || ch == '#' || (special && ch == '\\')) {
+            break;
+        }
+        has_open |= ch == '[';
+        has_close |= ch == ']';
+    }
+    return has_open == has_close ? start : -1;
+}
+
 /* Decompose the authority work[start,end) into userinfo (before the last '@'), host, and port. A '['-led host is an
    IPv6 literal reported without its brackets; a host of only ASCII digits and dots is an IPv4 literal; anything else is
    a registered name. The kind tells the shim which hosts skip IDNA and the sanitizer which to reject as a literal, so
@@ -271,6 +314,296 @@ void th_url_authority(const Py_UCS4 *work, Py_ssize_t start, Py_ssize_t end, th_
     out->kind = numeric ? TH_HOST_IPV4 : TH_HOST_REGNAME;
 }
 
+/* Parse one dot-separated part cp[start,end) as a WHATWG IPv4 number (https://url.spec.whatwg.org/#ipv4-number-parser):
+   a "0x" prefix is hexadecimal, a leading "0" is octal, otherwise decimal; the stripped-prefix empty string is 0. The
+   caller lowercases the host first, so only the lowercase "0x" prefix appears. Returns 1 with *out set, or 0 when a
+   digit is not valid for the radix or the value exceeds 2^32-1. */
+static int ipv4_number(const Py_UCS4 *cp, Py_ssize_t start, Py_ssize_t end, uint64_t *out) {
+    Py_ssize_t len = end - start;
+    if (len == 0) {
+        return 0;
+    }
+    int radix = 10;
+    Py_ssize_t index = start;
+    if (len >= 2 && cp[start] == '0' && cp[start + 1] == 'x') {
+        radix = 16;
+        index = start + 2;
+    } else if (len >= 2 && cp[start] == '0') {
+        radix = 8;
+        index = start + 1;
+    }
+    uint64_t value = 0;
+    for (; index < end; index++) {
+        int digit = hex_value(cp[index]); /* 0-15 or -1; the radix check rejects a digit the base does not allow */
+        if (digit < 0 || digit >= radix) {
+            return 0;
+        }
+        value = value * (uint64_t)radix + (uint64_t)digit;
+        if (value > 0xFFFFFFFFULL) {
+            return 0; /* a single IPv4 number never exceeds the 32-bit address space */
+        }
+    }
+    *out = value; /* an all-prefix part ("0", "0x") leaves value 0, the empty-after-prefix number */
+    return 1;
+}
+
+/* The dotted-decimal serialization of `ascii` read as a WHATWG IPv4 address
+   (https://url.spec.whatwg.org/#concept-ipv4-parser), or NULL (no error) when it is not one, so the caller keeps the
+   domain. At most four dot-separated parts (a lone trailing dot drops), each an IPv4 number; every part but the last is
+   one octet, and the last fills the rest. */
+static PyObject *maybe_ipv4(PyObject *ascii) {
+    Py_ssize_t len = PyUnicode_GET_LENGTH(ascii);
+    if (len == 0) {
+        return NULL;
+    }
+    int kind = PyUnicode_KIND(ascii);
+    const void *data = PyUnicode_DATA(ascii);
+    Py_UCS4 *cp = PyMem_Malloc((size_t)len * sizeof(Py_UCS4));
+    if (cp == NULL) {            /* GCOVR_EXCL_BR_LINE: allocation failure cannot be forced from a test */
+        return PyErr_NoMemory(); /* GCOVR_EXCL_LINE: allocation-failure path */
+    }
+    for (Py_ssize_t index = 0; index < len; index++) {
+        cp[index] = PyUnicode_READ(kind, data, index);
+    }
+    Py_ssize_t part_start[5];
+    Py_ssize_t part_end[5];
+    int count = 0;
+    int too_many = 0;
+    Py_ssize_t segment = 0;
+    for (Py_ssize_t index = 0; index <= len; index++) {
+        if (index != len && cp[index] != '.') {
+            continue;
+        }
+        if (count == 5) {
+            too_many = 1;
+            break;
+        }
+        part_start[count] = segment;
+        part_end[count] = index;
+        count++;
+        segment = index + 1;
+    }
+    if (!too_many && count > 1 && part_end[count - 1] == part_start[count - 1]) {
+        count--; /* a single trailing dot, "1.2.3.4.", drops its empty final part */
+    }
+    PyObject *result = NULL;
+    uint64_t numbers[4];
+    int ok = !too_many && count <= 4;
+    for (int part = 0; ok && part < count; part++) {
+        ok = ipv4_number(cp, part_start[part], part_end[part], &numbers[part]);
+    }
+    PyMem_Free(cp);
+    if (!ok) {
+        return NULL;
+    }
+    for (int part = 0; part < count - 1; part++) {
+        if (numbers[part] > 255) {
+            return NULL; /* every part but the last is a single octet */
+        }
+    }
+    uint64_t limit = 1;
+    for (int octet = 0; octet < 5 - count; octet++) {
+        limit *= 256;
+    }
+    if (numbers[count - 1] >= limit) {
+        return NULL; /* the last part fills the remaining octets, so it is bounded by 256^(5-count) */
+    }
+    uint32_t address = (uint32_t)numbers[count - 1];
+    for (int part = 0; part < count - 1; part++) {
+        address += (uint32_t)numbers[part] << (8 * (3 - part));
+    }
+    char buf[16];
+    int written =
+        snprintf(buf, sizeof(buf), "%u.%u.%u.%u", (unsigned)(address >> 24 & 0xFF), (unsigned)(address >> 16 & 0xFF),
+                 (unsigned)(address >> 8 & 0xFF), (unsigned)(address & 0xFF));
+    result = PyUnicode_FromStringAndSize(buf, written);
+    return result;
+}
+
+/* The lowercased, domain-to-ASCII form of a registered name (host parsing, URL standard 3.5): the lowercased host when
+   it is already ASCII, else UTS #46 ToASCII in C, falling back to the lowercased host when a label holds a code point
+   punycode cannot encode (an unpaired surrogate), the advisory behavior the later percent-encoder then rejects. */
+static PyObject *domain_to_ascii(PyObject *host) {
+    PyObject *lowered = PyObject_CallMethod(host, "lower", NULL);
+    if (lowered == NULL) { /* GCOVR_EXCL_BR_LINE: str.lower cannot fail on a host */
+        return NULL;       /* GCOVR_EXCL_LINE: allocation-failure path */
+    }
+    if (PyUnicode_IS_ASCII(lowered)) {
+        return lowered;
+    }
+    PyObject *encoded = th_url_to_ascii(lowered);
+    if (encoded != NULL) {
+        Py_DECREF(lowered);
+        return encoded;
+    }
+    if (!PyErr_ExceptionMatches(PyExc_ValueError)) { /* GCOVR_EXCL_BR_LINE: ToASCII raises nothing else */
+        Py_DECREF(lowered);                          /* GCOVR_EXCL_LINE: allocation-failure path */
+        return NULL;                                 /* GCOVR_EXCL_LINE */
+    }
+    PyErr_Clear();
+    return lowered;
+}
+
+/* Parse cp[0,len) as a WHATWG IPv6 address into eight 16-bit pieces (https://url.spec.whatwg.org/#concept-ipv6-parser),
+   returning 1 on success. A single "::" compresses one run of zero pieces. Embedded IPv4 dotted tails are not parsed
+   here (a '.' ends the scan with failure), so such a literal keeps its given spelling rather than being rewritten. */
+static int ipv6_parse(const Py_UCS4 *cp, Py_ssize_t len, uint16_t out[8]) {
+    for (int index = 0; index < 8; index++) {
+        out[index] = 0;
+    }
+    if (len == 0) {
+        return 0;
+    }
+    int piece = 0;
+    int compress = -1;
+    Py_ssize_t index = 0;
+    if (cp[0] == ':') {
+        if (len < 2 || cp[1] != ':') {
+            return 0; /* a lone leading ':' is not the "::" compressor */
+        }
+        index = 2;
+        compress = 0;
+    }
+    while (index < len) {
+        if (piece == 8) {
+            return 0; /* more than eight pieces */
+        }
+        if (cp[index] == ':') {
+            if (compress >= 0) {
+                return 0; /* a second "::" */
+            }
+            index++;
+            compress = piece;
+            continue;
+        }
+        uint32_t value = 0;
+        int length = 0;
+        while (length < 4 && index < len) {
+            int digit = hex_value(cp[index]);
+            if (digit < 0) {
+                break;
+            }
+            value = value * 16 + (uint32_t)digit;
+            index++;
+            length++;
+        }
+        if (length == 0) {
+            return 0; /* a group with no hex digit (a '.' tail or stray byte) */
+        }
+        out[piece++] = (uint16_t)value;
+        if (index == len) {
+            break;
+        }
+        if (cp[index] != ':') {
+            return 0;
+        }
+        index++;
+        if (index == len) {
+            return 0; /* a trailing ':' with no group after it */
+        }
+    }
+    if (compress >= 0) {
+        int swaps = piece - compress;
+        int at = 8; /* swaps <= piece <= 8 = at, so swaps reaches 0 while at is still positive; no at>0 guard needed */
+        while (swaps > 0) {
+            uint16_t tmp = out[at - 1];
+            out[at - 1] = out[compress + swaps - 1];
+            out[compress + swaps - 1] = tmp;
+            at--;
+            swaps--;
+        }
+    } else if (piece != 8) {
+        return 0; /* no compressor, so all eight pieces must be present */
+    }
+    return 1;
+}
+
+/* Serialize eight IPv6 pieces (https://url.spec.whatwg.org/#concept-ipv6-serializer): lowercase hex groups joined by
+   ':', with the first longest run of two or more zero pieces collapsed to "::". */
+static PyObject *ipv6_serialize(const uint16_t pieces[8]) {
+    int best_start = -1;
+    int best_len = 0;
+    int run_start = -1;
+    int run_len = 0;
+    for (int index = 0; index < 8; index++) {
+        if (pieces[index] != 0) {
+            run_start = -1;
+            run_len = 0;
+            continue;
+        }
+        if (run_start < 0) {
+            run_start = index;
+        }
+        run_len++;
+        if (run_len > best_len) {
+            best_len = run_len;
+            best_start = run_start;
+        }
+    }
+    int compress = best_len >= 2 ? best_start : -1;
+    char buf[48];
+    int at = 0;
+    int ignore_zeros = 0;
+    for (int index = 0; index < 8; index++) {
+        if (ignore_zeros && pieces[index] == 0) {
+            continue;
+        }
+        ignore_zeros = 0;
+        if (index == compress) {
+            buf[at++] = ':';
+            if (index == 0) {
+                buf[at++] = ':';
+            }
+            ignore_zeros = 1;
+            continue;
+        }
+        at += snprintf(buf + at, sizeof(buf) - (size_t)at, "%x", pieces[index]);
+        if (index != 7) {
+            buf[at++] = ':';
+        }
+    }
+    return PyUnicode_FromStringAndSize(buf, at);
+}
+
+PyObject *th_url_host_canonical(PyObject *host, int kind) {
+    if (kind == TH_HOST_IPV6) {
+        Py_ssize_t len = PyUnicode_GET_LENGTH(host);
+        int host_kind = PyUnicode_KIND(host);
+        const void *data = PyUnicode_DATA(host);
+        Py_UCS4 *cp = PyMem_Malloc(((size_t)len + 1) * sizeof(Py_UCS4));
+        if (cp == NULL) {            /* GCOVR_EXCL_BR_LINE: allocation failure cannot be forced from a test */
+            return PyErr_NoMemory(); /* GCOVR_EXCL_LINE: allocation-failure path */
+        }
+        for (Py_ssize_t index = 0; index < len; index++) {
+            cp[index] = PyUnicode_READ(host_kind, data, index);
+        }
+        uint16_t pieces[8];
+        PyObject *result =
+            ipv6_parse(cp, len, pieces) ? ipv6_serialize(pieces) : PyObject_CallMethod(host, "lower", NULL);
+        PyMem_Free(cp);
+        return result;
+    }
+    PyObject *decoded = th_url_percent_decode_obj(host);
+    if (decoded == NULL) { /* GCOVR_EXCL_BR_LINE: decode only fails on the excluded allocation path */
+        return NULL;       /* GCOVR_EXCL_LINE: allocation-failure path */
+    }
+    PyObject *ascii = domain_to_ascii(decoded);
+    Py_DECREF(decoded);
+    if (ascii == NULL) { /* GCOVR_EXCL_BR_LINE: domain_to_ascii only fails on the excluded allocation path */
+        return NULL;     /* GCOVR_EXCL_LINE: allocation-failure path */
+    }
+    PyObject *ipv4 = maybe_ipv4(ascii);
+    if (ipv4 != NULL) {
+        Py_DECREF(ascii);
+        return ipv4;
+    }
+    if (PyErr_Occurred()) { /* GCOVR_EXCL_BR_LINE: maybe_ipv4 only errors on the excluded allocation path */
+        Py_DECREF(ascii);   /* GCOVR_EXCL_LINE: allocation-failure path */
+        return NULL;        /* GCOVR_EXCL_LINE */
+    }
+    return ascii;
+}
+
 /* _url_split(url) -> (scheme, netloc, path, query, fragment, userinfo, host, port, has_port, host_kind). scheme is
    lowercased; the host is the bracket-stripped ASCII span; every other component is the verbatim slice. Raises
    ValueError on an authority with an unbalanced '['/']' pair. The shim guarantees a str argument, as the other _html
@@ -311,13 +644,14 @@ int th_url_split(PyObject *arg, th_url_parts *out) {
     for (Py_ssize_t index = 0; index < scheme_end; index++) {
         work[index] |= 0x20; /* scheme chars are ASCII; |0x20 lowercases a letter and is identity on a digit or +-. */
     }
+    int special = scheme_end > 0 && th_url_scheme_special(work, 0, scheme_end);
     Py_ssize_t body = scheme_end >= 0 ? scheme_end + 1 : 0;
     Py_ssize_t netloc_start = body;
     Py_ssize_t netloc_end = body;
     Py_ssize_t rem = body;
-    if (body + 1 < len && work[body] == '/' && work[body + 1] == '/') {
+    if (body + 1 < len && url_slash(work[body], special) && url_slash(work[body + 1], special)) {
         netloc_start = body + 2;
-        netloc_end = th_url_authority_end(work, netloc_start, len);
+        netloc_end = authority_end(work, netloc_start, len, special);
         rem = netloc_end;
         if (netloc_end < 0) {
             PyMem_Free(work);
@@ -419,8 +753,10 @@ typedef struct {
    tab, newline, and carriage return, read a scheme when a leading letter runs to the first ':' over scheme characters,
    an authority after '//', and the query and fragment at the first '?' and '#'. Owns a freshly allocated buffer stored
    in `out->buf`. Returns -1 with a ValueError on an authority whose '['/']' pair is unbalanced (the one split-time
-   failure urljoin surfaces), matching turbohtml_url_split's shallow host check. */
-static int parse_ref(PyObject *src, url_ref *out) {
+   failure urljoin surfaces), matching turbohtml_url_split's shallow host check. `special_hint` is the effective
+   scheme's specialness for a schemeless reference (the base's, in a join), deciding whether '\' opens and ends the
+   authority. */
+static int parse_ref(PyObject *src, url_ref *out, int special_hint) {
     Py_ssize_t raw_len = PyUnicode_GET_LENGTH(src);
     int kind = PyUnicode_KIND(src);
     const void *data = PyUnicode_DATA(src);
@@ -472,10 +808,11 @@ static int parse_ref(PyObject *src, url_ref *out) {
             rest = colon + 1;
         }
     }
+    int special = out->has_scheme ? th_url_scheme_special(buf, out->scheme_start, out->scheme_end) : special_hint;
     out->has_netloc = 0;
-    if (rest + 1 < len && buf[rest] == '/' && buf[rest + 1] == '/') {
+    if (rest + 1 < len && url_slash(buf[rest], special) && url_slash(buf[rest + 1], special)) {
         Py_ssize_t netloc_start = rest + 2;
-        Py_ssize_t netloc_end = th_url_authority_end(buf, netloc_start, len);
+        Py_ssize_t netloc_end = authority_end(buf, netloc_start, len, special);
         if (netloc_end < 0) {
             PyMem_Free(buf);
             PyErr_SetString(PyExc_ValueError, "Invalid IPv6 URL");
@@ -705,10 +1042,13 @@ PyObject *th_url_join(PyObject *base, PyObject *target) {
     }
     url_ref base_parts;
     url_ref ref_parts;
-    if (parse_ref(base, &base_parts) < 0) {
+    if (parse_ref(base, &base_parts, 0) < 0) {
         return NULL;
     }
-    if (parse_ref(target, &ref_parts) < 0) {
+    /* a schemeless reference inherits the base's scheme, so its '\' handling follows whether the base is special */
+    int base_special =
+        base_parts.has_scheme && th_url_scheme_special(base_parts.buf, base_parts.scheme_start, base_parts.scheme_end);
+    if (parse_ref(target, &ref_parts, base_special) < 0) {
         PyMem_Free(base_parts.buf);
         return NULL;
     }
diff --git a/src/turbohtml/_c/url/url.h b/src/turbohtml/_c/url/url.h
index e2369d711..a9b4f9e44 100644
--- a/src/turbohtml/_c/url/url.h
+++ b/src/turbohtml/_c/url/url.h
@@ -37,6 +37,11 @@ static inline int th_scheme_start(Py_UCS4 ch) {
     return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z');
 }
 
+/* Whether buf[start,end) names a WHATWG special scheme (ftp, file, http, https, ws, wss), compared case-insensitively
+   (https://url.spec.whatwg.org/#special-scheme). Only these treat U+005C (\) like / in the authority and relative
+   states, so url_split, the relative join, and the sanitizer host scan gate their backslash handling on it. */
+int th_url_scheme_special(const Py_UCS4 *buf, Py_ssize_t start, Py_ssize_t end);
+
 /* Bleach accepts bracketed hostnames such as [bad]. */
 static inline Py_ssize_t th_url_authority_end(const Py_UCS4 *value, Py_ssize_t start, Py_ssize_t len) {
     int has_open = 0;
diff --git a/tests/clean/test_sanitize.py b/tests/clean/test_sanitize.py
index 9d38cc440..7826fa201 100644
--- a/tests/clean/test_sanitize.py
+++ b/tests/clean/test_sanitize.py
@@ -1734,6 +1734,23 @@ def test_media_host_ipv6_literal_rejected_even_when_listed() -> None:
     assert "src=" not in sanitize('<video src="https://[::1]/x">', policy)
 
 
+@pytest.mark.parametrize(
+    ("src", "kept"),
+    [
+        pytest.param("https://evil.com\\@youtube.com/x", False, id="backslash-userinfo-host-evil"),
+        pytest.param("//evil.com\\@youtube.com/x", False, id="protocol-relative-backslash"),
+        pytest.param("https:\\\\evil.com\\@youtube.com/x", False, id="backslash-authority-opener"),
+        pytest.param("https://youtube.com\\@evil.com/x", True, id="backslash-ends-authority-at-listed-host"),
+        pytest.param("https://youtube.com/a\\b", True, id="backslash-in-path-keeps-host"),
+    ],
+)
+def test_media_host_allowlist_rejects_backslash_authority(src: str, kept: bool) -> None:  # ruff:ignore[boolean-type-hint-positional-argument]
+    # a browser ends a special-scheme authority at '\', so evil.com\@youtube.com resolves to evil.com; the allowlist
+    # must see that host, not the userinfo-trick tail it used to read as youtube.com
+    out = sanitize(f'<video src="{src}">', _media_policy(frozenset({"youtube.com"})))
+    assert ("src=" in out) is kept
+
+
 def test_report_records_a_removed_element() -> None:
     out, removed = sanitize_report("<p>ok <script>evil()</script> done</p>")
     assert Removed("script", None) in removed
diff --git a/tests/extract/test_links.py b/tests/extract/test_links.py
index 97353d7a5..c26707330 100644
--- a/tests/extract/test_links.py
+++ b/tests/extract/test_links.py
@@ -133,6 +133,19 @@ def test_external_boundary_with_a_hostless_base_keeps_every_absolute_link() -> N
     assert extract_links(html, "mailto:me@example.org", external_only=True) == {"https://a.example/x"}
 
 
+def test_external_only_canonicalizes_ipv4_hosts_before_comparing() -> None:
+    # 0x7f.0.0.1 and 127.1 are 127.0.0.1 to a browser, so they are internal to the loopback base and drop; only the
+    # genuinely other host survives
+    html = '<a href="http://0x7f.0.0.1/a">1</a><a href="http://127.1/b">2</a><a href="http://8.8.8.8/c">3</a>'
+    assert extract_links(html, "http://127.0.0.1/", external_only=True) == {"http://8.8.8.8/c"}
+
+
+def test_external_only_attributes_backslash_authority_to_the_real_host() -> None:
+    # a browser resolves evil.example\@good.example to evil.example, so the link leaves the base's site and is kept
+    html = '<a href="http://evil.example\\@good.example/">x</a>'
+    assert extract_links(html, "http://good.example/", external_only=True) == {"http://evil.example\\@good.example/"}
+
+
 def test_external_only_requires_a_base() -> None:
     with pytest.raises(ValueError, match="external_only requires a base_url"):
         extract_links('<a href="https://a.example/">x</a>', external_only=True)
@@ -522,6 +535,20 @@ def test_a_longer_replacement_grows_the_value() -> None:
     assert out == '<a href="https://example.com/very/deep/path/x">t</a>'
 
 
+@pytest.mark.parametrize(
+    "href",
+    [
+        pytest.param("\\\\evil.test/x", id="double-backslash"),
+        pytest.param("/\\evil.test/x", id="slash-backslash"),
+        pytest.param("\\/evil.test/x", id="backslash-slash"),
+    ],
+)
+def test_resolve_links_attributes_backslash_scheme_relative_to_the_real_host(href: str) -> None:
+    # resolve_links joins through the C _url_join, which (unlike stdlib urljoin) ends a special-scheme authority at '\',
+    # so a scheme-relative reference resolves to the host a browser would fetch
+    assert _resolved_href(href, _RESOLVE_BASE) == "https://evil.test/x"
+
+
 @pytest.mark.parametrize(
     "html",
     [
diff --git a/tests/url/test_clean.py b/tests/url/test_clean.py
index 964cd5c3b..d01d0985b 100644
--- a/tests/url/test_clean.py
+++ b/tests/url/test_clean.py
@@ -544,3 +544,103 @@ def test_tracker_suffix_and_word_boundaries(url: str, expected: str) -> None:
 )
 def test_dot_segment_resolution(url: str, expected: str) -> None:
     assert clean_url(url) == expected
+
+
+@pytest.mark.parametrize(
+    ("url", "expected"),
+    [
+        pytest.param("http://2130706433/", "http://127.0.0.1/", id="decimal"),
+        pytest.param("http://0x7f.0.0.1/", "http://127.0.0.1/", id="hex-label"),
+        pytest.param("http://0X7F.0.0.1/", "http://127.0.0.1/", id="uppercase-hex-label"),
+        pytest.param("http://0177.0.0.1/", "http://127.0.0.1/", id="octal-label"),
+        pytest.param("http://127.1/", "http://127.0.0.1/", id="short-form"),
+        pytest.param("http://1.256/", "http://1.0.1.0/", id="two-part-wide-last"),
+        pytest.param("http://1.2.3.4/", "http://1.2.3.4/", id="dotted-quad-unchanged"),
+        pytest.param("http://1.2.3.4./", "http://1.2.3.4/", id="trailing-dot-dropped"),
+        pytest.param("http://0x.0.0.0/", "http://0.0.0.0/", id="empty-after-hex-prefix"),
+        pytest.param("http://12345/", "http://0.0.48.57/", id="bare-number-fills-octets"),
+    ],
+)
+def test_normalize_url_parses_ipv4_hosts(url: str, expected: str) -> None:
+    # the WHATWG host parser reads a host ending in a number as IPv4 (all four notations) and emits dotted-decimal
+    assert normalize_url(url) == expected
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        pytest.param("http://999.999.999.999/", id="octet-over-255"),
+        pytest.param("http://256.1.1.1/", id="first-octet-over-255"),
+        pytest.param("http://1.2.3.256/", id="last-octet-over-limit"),
+        pytest.param("http://1.2.3.4.5/", id="five-parts"),
+        pytest.param("http://1.2.3.4.5.6/", id="too-many-parts"),
+        pytest.param("http://0888.1.1.1/", id="bad-octal-digit"),
+        pytest.param("http://99999999999/", id="number-over-32-bits"),
+        pytest.param("http://foo.0x1/", id="non-numeric-leading-part"),
+        pytest.param("http://1..2.3/", id="empty-interior-part"),
+    ],
+)
+def test_normalize_url_keeps_non_ipv4_numeric_hosts(url: str) -> None:
+    # a host that looks numeric but is not a valid IPv4 address is left as the registered name it is
+    assert normalize_url(url) == url
+
+
+@pytest.mark.parametrize(
+    ("url", "expected"),
+    [
+        pytest.param("http://[0:0:0:0:0:0:0:1]/", "http://[::1]/", id="expanded-loopback"),
+        pytest.param("http://[2001:db8::1]/", "http://[2001:db8::1]/", id="already-compressed"),
+        pytest.param(
+            "http://[2001:0db8:0000:0000:0000:0000:0000:0001]/", "http://[2001:db8::1]/", id="leading-zeros-and-run"
+        ),
+        pytest.param("http://[2001:DB8::AB]/", "http://[2001:db8::ab]/", id="uppercase-hex-lowercased"),
+        pytest.param("http://[1:2:3:4:5:6:7:8]/", "http://[1:2:3:4:5:6:7:8]/", id="no-zero-run"),
+        pytest.param("http://[1:0:2:0:3:0:4:0]/", "http://[1:0:2:0:3:0:4:0]/", id="isolated-zeros-not-compressed"),
+        pytest.param("http://[fe80:0:0:0:0:0:0:0]/", "http://[fe80::]/", id="trailing-zero-run"),
+        pytest.param("http://[2001:db8:0:0:1:0:0:1]/", "http://[2001:db8::1:0:0:1]/", id="first-longest-run-wins"),
+        pytest.param("http://[::]/", "http://[::]/", id="all-zeros"),
+    ],
+)
+def test_normalize_url_canonicalizes_ipv6_hosts(url: str, expected: str) -> None:
+    # the WHATWG IPv6 serializer drops leading zeros and compresses the first longest zero run, so twins compare equal
+    assert normalize_url(url) == expected
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        pytest.param("http://[::ffff:1.2.3.4]/", id="embedded-ipv4-tail"),
+        pytest.param("http://[::1x]/", id="trailing-non-hex"),
+        pytest.param("http://[1:2:3]/", id="too-few-groups"),
+        pytest.param("http://[:::1]/", id="double-compressor"),
+        pytest.param("http://[:1]/", id="leading-single-colon"),
+        pytest.param("http://[:]/", id="lone-colon"),
+        pytest.param("http://[]/", id="empty-brackets"),
+        pytest.param("http://[::g]/", id="non-hex-group"),
+        pytest.param("http://[::1:]/", id="trailing-colon"),
+        pytest.param("http://[1:2:3:4:5:6:7:8:9]/", id="nine-groups"),
+    ],
+)
+def test_normalize_url_keeps_malformed_ipv6_lowercased(url: str) -> None:
+    # a literal the compact IPv6 parser does not accept (an embedded-IPv4 tail, or an invalid form) keeps its spelling
+    assert normalize_url(url) == url.lower()
+
+
+def test_normalize_url_keeps_an_empty_host() -> None:
+    # a port-only authority has no host to parse as IPv4, so the empty host round-trips
+    assert normalize_url("http://:80/x") == "http:///x"
+
+
+@pytest.mark.parametrize(
+    ("url", "expected"),
+    [
+        pytest.param("http://good%2eexample/", "http://good.example/", id="percent-dot"),
+        pytest.param(
+            "http://trusted.example%2eattacker.example/", "http://trusted.example.attacker.example/", id="split-label"
+        ),
+        pytest.param("http://caf%C3%A9.example/", "http://xn--caf-dma.example/", id="percent-utf8-to-punycode"),
+    ],
+)
+def test_normalize_url_percent_decodes_host(url: str, expected: str) -> None:
+    # the WHATWG host parser percent-decodes the host before domain-to-ASCII, so an encoded separator is the real one
+    assert normalize_url(url) == expected
diff --git a/tests/url/test_url.py b/tests/url/test_url.py
index 20c76a5a3..481a9f3b1 100644
--- a/tests/url/test_url.py
+++ b/tests/url/test_url.py
@@ -1299,3 +1299,42 @@ def test_variant_key_cases(url: str, expected: str) -> None:
 def test_variant_key_rejects_non_str() -> None:
     with pytest.raises(TypeError, match="must be str"):
         _url_variant_key(123)  # ty: ignore[invalid-argument-type]  # a non-str exercises the TypeError guard
+
+
+@pytest.mark.parametrize(
+    ("url", "host", "path"),
+    [
+        pytest.param("http://evil.example\\@good.example/", "evil.example", "\\@good.example/", id="http-userinfo"),
+        pytest.param("https://evil\\@good/", "evil", "\\@good/", id="https-userinfo"),
+        pytest.param("ws://evil\\@good/", "evil", "\\@good/", id="ws-userinfo"),
+        pytest.param("ftp://evil\\@good/", "evil", "\\@good/", id="ftp-userinfo"),
+        pytest.param("file://evil\\@good/", "evil", "\\@good/", id="file-userinfo"),
+        pytest.param("http:\\\\host\\path", "host", "\\path", id="backslash-authority-opener"),
+        pytest.param("http:/\\host/p", "host", "/p", id="mixed-slash-opener"),
+    ],
+)
+def test_url_split_ends_special_authority_at_backslash(url: str, host: str, path: str) -> None:
+    # a browser ends a special-scheme authority at '\', so the host is the span before it, not the userinfo trick's tail
+    _scheme, _netloc, split_path, _query, _fragment, _userinfo, split_host, *_rest = _url_split(url)
+    assert (split_host, split_path) == (host, path)
+
+
+@pytest.mark.parametrize("scheme", ["gopher", "mailto", "nntp"])
+def test_url_split_keeps_backslash_host_for_non_special_scheme(scheme: str) -> None:
+    # a non-special scheme does not treat '\' as a separator, so it stays urllib-compatible
+    url = f"{scheme}://evil\\@good.example/"
+    assert _url_split(url)[6] == urlsplit(url).hostname
+
+
+@pytest.mark.parametrize(
+    ("base", "reference", "expected"),
+    [
+        pytest.param("http://good/a/b", "\\\\evil/x", "http://evil/x", id="double-backslash"),
+        pytest.param("http://good/a/b", "/\\evil/x", "http://evil/x", id="slash-backslash"),
+        pytest.param("http://good/a/b", "\\/evil/x", "http://evil/x", id="backslash-slash"),
+        pytest.param("ftp://good/a/b", "\\\\evil/x", "ftp://evil/x", id="special-ftp"),
+        pytest.param("mailto:good", "\\\\evil/x", "\\\\evil/x", id="non-special-verbatim"),
+    ],
+)
+def test_url_join_resolves_backslash_scheme_relative(base: str, reference: str, expected: str) -> None:
+    assert _url_join(base, reference) == expected