Advanced IP Defense uses a globally distributed cloud infrastructure to deliver real-time IP attribute lookups and direct-to-IP detection verdicts. When a firewall encounters a connection that requires a cloud lookup, it communicates with the nearest regional service domain over HTTPS (port 443) to retrieve IP attributes and cache them locally. The firewall automatically connects to the closest regional endpoint to minimize lookup latency.

To ensure uninterrupted Advanced IP Defense protection, you must allow outbound HTTPS access from your enforcement points to the Advanced IP Defense service domains listed below. If your environment uses a firewall, proxy, or other network security device that restricts outbound traffic, add these domains to your allowlist.