Recent updates to this article 

Date	Update
September 16, 2020	Updated to refer to the product documentation for the Global Threat Intelligence (GTI) FQDN for each product.
September 14, 2020	Moved non-Global Threat Intelligence ENS off-box communication URLs to KB93324.
January 17, 2020	Added the following Asia Pacific​ IP addresses in the "Additional configuration details" section: 3.1.208.14, 3.1.172.253, 13.251.72.88, 13.251.160.226, 18.141.7.33, 18.136.232.217, 18.138.54.213, 18.139.198.177, 18.139.210.109, 52.74.48.212, 52.76.69.100, 52.221.56.160.
December 17, 2019	Updated the "Additional configuration details" section that since 2018 the use of Public Cloud resources to augment the Global Threat Intelligence (GTI) Cloud was expanded. So, a client might be directed to a GTI Cloud PoP in the Public Cloud.

The purpose of this article is to provide the Global Threat Intelligence (GTI) IP addresses to allow so that your network can query GTI. But, McAfee recommends the use of a fully qualified domain name (FQDN) that returns a list of active endpoints at the nearest Cloud Point of Presence (PoP). IP addresses can change and to decouple endpoints from these changes, endpoints should not hardcode IP addresses mentioned in this article. McAfee is providing the list of IP addresses for allow list purposes only.

GTI is hosted as a global cloud service, so hard coding an IP address could result in an outage for one of the following reasons:

• That particular IP address is taken out of service for maintenance.
• A network outage segments a static path to a given IP address in a given data center.
• GTI site host changes.

Access to GTI is configured on port 443 using an FQDN so that a DNS lookup can return the nearest and most accurate IP address records at any given time. This returned result can be any of several IP addresses across the globe. Because the exact IP address is not known in advance, firewall administrators must open port 443 outbound globally. The preferred configuration method is to configure access to the GTI servers to use port 443 to the FQDN.

Product FQDNs used with GTI
The FQDN depends on the product. To determine the FQDN, see the product documentation for your installed product.

For a list and description of the ENS URLs used to perform off-box communication, see KB93324.

Public Cloud resource IP addresses: