Cloud IP Addresses

Last updated: Nov. 1, 2023

Overview
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

US-1 IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: ts01-b.cloudsink.net

IPs:

13.56.127.239

13.56.225.158

13.57.54.63

13.57.64.97

13.57.84.142

50.18.194.39

52.8.5.240

52.8.19.75

52.8.27.14

52.8.32.113

52.8.45.162

52.8.52.230

52.8.54.244

52.8.61.206

52.8.134.130

52.8.160.82

52.8.172.89

52.8.173.58

52.8.212.212

52.8.216.81

52.9.7.10

52.9.77.209
52.9.82.94

52.9.87.98

52.9.104.148

52.9.146.225

52.9.212.176

52.52.117.52

52.52.119.33

52.52.149.168

52.52.239.58

52.53.77.89

54.67.6.201

54.67.26.184

54.67.33.233

54.67.47.58

54.67.48.56

54.67.54.116

54.67.68.88

54.67.92.206

54.67.96.255

54.67.99.247

54.67.105.202

54.67.119.89

54.67.123.150

54.67.123.234

54.67.125.81

54.177.119.54

54.177.202.146

54.183.24.162

54.183.24.211

54.183.34.154

54.183.39.68

54.183.51.31

54.183.51.69

54.183.52.221

54.183.105.3

54.183.122.156

54.183.140.32

54.183.142.105

54.183.148.43
54.183.148.116

54.183.232.230

54.183.234.42

54.183.252.86

54.193.27.226

54.193.29.47

54.193.33.135

54.193.52.110

54.193.67.98

54.193.87.57

54.193.90.171

54.193.93.19

54.193.117.199

54.215.96.32

54.215.131.232

54.215.154.80

54.215.169.38

54.215.169.199

54.215.169.220

54.215.176.108

54.215.177.122

54.215.183.157

54.215.226.55

54.219.112.243

54.219.115.12

54.219.137.54

54.219.138.168

54.219.140.50

54.219.141.250

54.219.145.181

54.219.147.253

54.219.148.161

54.219.149.89

54.219.149.92

54.219.151.1

54.219.151.27

54.219.153.248

54.219.158.53

54.219.159.84
 54.219.161.141

54.241.48.136

54.241.138.180

54.241.142.171

54.241.146.67

54.241.148.127

54.241.149.173

54.241.150.134

54.241.161.60

54.241.162.64

54.241.162.180

54.241.164.212

54.241.175.52

54.241.175.140

54.241.175.161

54.241.179.52

54.241.181.242

54.241.184.161

54.241.185.201

54.241.186.124

54.241.197.58

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: lfodown01-b.cloudsink.net

IPs:

13.56.121.58

50.18.198.237

52.8.141.1

54.67.4.108

54.67.5.136

54.67.17.131

54.67.24.156

54.67.41.192

54.67.51.32

54.67.72.218

54.67.78.134

54.67.108.17
 54.67.114.188

54.67.122.238

54.183.120.141

54.183.135.80

54.183.215.154

54.193.86.245

54.215.170.42

54.219.179.25

54.241.161.242

54.241.181.78

54.241.182.78

54.241.183.151

54.241.183.229

54.241.183.232

LFO upload
Public DNS Name: lfoup01-b.cloudsink.net

IPs:

54.151.103.156

54.151.121.185

184.169.155.1

184.169.163.158

Falcon console
Public DNS Names:

https://falcon.crowdstrike.com

https://assets.falcon.crowdstrike.com

https://assets-public.falcon.crowdstrike.com

OAuth2-based API IPs

Public DNS Name: https://api.crowdstrike.com

IPs:

13.56.9.61

54.241.246.108

Event Streams API

Public DNS Name: https://firehose.crowdstrike.com

IPs:

13.57.89.142
 50.18.214.143

50.18.218.76

52.8.91.45

52.8.136.252

52.8.177.134

52.8.197.118

52.9.56.119

52.9.71.44

52.9.80.133

52.9.92.226

52.52.13.248

52.52.109.138

52.52.109.193

54.67.37.78

54.67.64.61

54.153.32.47

54.153.53.61

54.176.148.178

54.177.76.236

54.177.136.44

54.183.77.16

54.183.120.0

54.183.177.9

54.183.185.106

54.183.229.90

54.193.120.72

54.241.49.118

US-2 IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: ts01-gyr-maverick.cloudsink.net

IPs:

35.162.224.228

35.162.239.174

50.112.129.218

50.112.130.23
 50.112.131.18

52.25.223.26

52.33.193.184

52.35.11.124

52.35.162.27

54.68.92.116

54.71.43.66

100.20.76.137

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: lfodown01-gyr-maverick.cloudsink.net

IPs:

34.209.79.111

34.210.186.129

34.209.165.130

35.80.210.147

35.160.213.193

35.166.20.122

52.10.219.156

52.27.205.162

100.20.144.105

LFO upload
Public DNS Name: lfoup01-gyr-maverick.cloudsink.net

IPs:

34.214.236.51

34.215.239.163

44.228.118.64

44.229.24.18

50.112.6.52

54.191.184.169

Falcon console
Public DNS Names:

https://falcon.us-2.crowdstrike.com

https://assets.falcon.us-2.crowdstrike.com

https://assets-public.us-2.falcon.crowdstrike.com
IPs:

34.223.189.85

44.227.83.73

44.227.251.226

OAuth2-based API IPs

OAuth2-based APIs public DNS

For the US-2 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
api.us-2.crowdstrike.com

Event Streams API

Public DNS name: https://firehose.us-2.crowdstrike.com

IPs:

44.224.200.221

44.225.216.237

44.227.134.78

US-GOV-1 IPs

Term server
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: https://ts01-laggar-gcw.cloudsink.net

Elastic Load Balancer DNS Name: sensorproxy-laggar-g-524628337.us-gov-west-1.elb.amazonaws.com

IPs:

52.61.0.222

52.61.2.52

52.61.9.57

52.61.9.149

52.61.9.241

52.61.11.166

52.61.11.242

52.61.12.47

52.61.14.159

52.61.17.222

52.61.20.24

52.61.22.116

52.61.23.238

52.61.27.7
52.61.28.59

52.61.29.159

52.61.30.118

52.61.32.177

52.61.33.0

52.61.34.34

52.61.34.40

52.61.35.7

52.61.35.122

52.61.36.126

52.61.39.242

52.61.41.144

52.61.42.7

52.61.43.119

52.61.43.207

52.61.44.118

52.61.45.67

52.61.45.69

52.61.46.138

52.61.48.55

52.61.48.85

52.61.49.225

52.61.50.148

52.61.50.149

52.61.56.64

52.61.57.53

52.61.60.160

52.61.63.172

52.61.63.233

52.61.64.8

52.61.66.117

52.61.67.36

52.61.72.80

52.61.72.154

52.61.73.17

52.61.75.52

52.61.77.105

52.61.77.158

52.61.79.49
52.61.80.233

52.61.83.154

52.61.84.183

52.61.91.2

52.61.91.144

52.61.93.50

52.61.94.17

52.61.96.38

52.222.5.73

52.222.9.132

52.222.26.218

52.222.32.109

52.222.46.55

52.222.50.175

52.222.57.109

52.222.74.53

52.222.75.2

52.222.88.238

52.222.93.101

52.222.108.82

52.222.112.47

52.222.116.143

52.222.118.71

52.222.118.98

96.127.54.242

96.127.56.206

96.127.111.33

96.127.63.238

96.127.78.183

96.127.79.217

96.127.84.6

96.127.84.121

96.127.87.84

96.127.93.126

96.127.94.143

96.127.99.184

96.127.106.86

96.127.108.32

96.127.111.252
 96.127.114.88

2620:108:D00F::34de:6c52

2620:108:D00F::34de:702f

2620:108:D00F::34de:7647

2620:108:D00F::34de:206d

2620:108:D00F::34de:0549

2620:108:D00F::34de:5d65

2620:108:D00F::343d:0e9f

2620:108:D00F::343d:11de

2620:108:D00F::343d:0234

2620:108:D00F::343d:1674

2620:108:D00F::343d:17ee

2620:108:D00F::343d:1d9f

2620:108:D00F::343d:27f2

2620:108:D00F::343d:2a07

2620:108:D00F::343d:2c76

2620:108:D00F::343d:2d43

2620:108:D00F::343d:2e8a

2620:108:D00F::343d:3037

2620:108:D00F::343d:3840

2620:108:D00F::343d:3ca0

2620:108:D00F::343d:4324

2620:108:D00F::343d:4b34

2620:108:D00F::343d:54b7

2620:108:D00F::343d:0995

2620:108:D00F::343d:5b02

2620:108:D00F::343d:5e11

2620:108:D00F::607f:6c20

2620:108:D00F::607f:5754

2620:108:D00F::607f:5d7e

2620:108:D00F::607f:63b8

2620:108:d00f::343d:539a

2620:108:d00f::343d:4d9e

2620:108:d00f::343d:0939

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: https://lfodown01-laggar-gcw.cloudsink.net

 Elastic Load Balancer DNS Name: ELB-Laggar-P-LFO-DOWNLOAD-1265997121.us-gov-west-1.elb.amazonaws.com
IPs:

3.32.47.58

3.32.107.22

3.32.128.100

3.32.159.13

3.32.181.91

3.32.197.87

15.200.3.172

15.200.46.143

15.200.91.227

15.200.136.15

15.200.146.204

15.200.169.255

15.200.206.3

15.200.211.137

15.200.217.77

15.200.220.52

15.200.227.212

15.200.248.80

15.200.248.238

52.61.12.4

52.61.15.206

52.61.22.52

52.61.25.208

52.61.45.223

52.61.56.86

52.61.67.79

52.61.75.201

52.61.77.149

52.61.82.75

52.61.83.60

52.61.83.139

52.61.233.44

52.222.5.255

52.222.42.221

52.222.47.146

52.222.48.202

52.222.76.145
 52.222.79.100

52.222.96.101

52.222.109.240

96.127.67.59

96.127.84.208

96.127.109.48

96.127.113.82

96.127.115.126

160.1.50.240

2620:108:D00F::34de:6df0

2620:108:D00F::34de:2add

2620:108:D00F::34de:2f92

2620:108:D00F::34de:30ca

2620:108:D00F::34de:4c91

2620:108:D00F::34de:4f64

2620:108:D00F::343d:0c04

2620:108:D00F::343d:0fce

2620:108:D00F::343d:1634

2620:108:D00F::343d:19d0

2620:108:D00F::343d:3856

2620:108:D00F::343d:434f

2620:108:D00F::343d:4bc9

2620:108:D00F::343d:4d95

2620:108:D00F::343d:538b

2620:108:D00F::607f:7152

2620:108:D00F::607f:433b

2620:108:D00F::607f:54d0

2620:108:d00f::343d:524b

2620:108:d00f::34de:05ff

2620:108:d00f::34de:6065

Falcon console
Public DNS Name: https://falcon.laggar.gcw.crowdstrike.com

Elastic Load Balancer DNS Name: laggar-falconui01-g-245478519.us-gov-west-1.elb.amazonaws.com

IPs:

52.61.14.45

52.61.29.125

52.61.46.226

52.61.49.230
 52.61.54.66

52.61.57.16

52.61.66.9

52.61.66.97

52.61.68.8

52.61.68.44

52.61.77.66

52.61.86.16

52.61.90.103

52.61.93.127

52.61.96.202

52.222.14.13

52.222.20.118

52.222.46.86

96.127.39.199

96.127.58.128

2620:108:D00F::343d:0e2d

2620:108:D00F::343d:2ee2

2620:108:d00f::607f:3a80

OAuth2-based API IPs

OAuth2-based APIs public DNS

For the US-GOV-1 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
api.laggar.gcw.crowdstrike.com

Event Streams API

Public DNS Name: https://firehose.laggar.gcw.crowdstrike.com

Elastic Load Balancer DNS Name: falconhose-laggar01-g-720386815.us-gov-west-1.elb.amazonaws.com

IPs:

52.61.2.4

52.61.7.132

52.61.13.204

52.61.25.210

52.61.55.125

52.61.57.211

52.61.60.100

52.61.87.201

52.61.89.212

52.61.93.190
 52.61.95.243

52.222.14.131

52.222.59.20

52.222.97.81

52.222.108.7

96.127.77.234

96.127.89.44

96.127.98.128

96.127.108.36

96.127.111.3

2620:108:D00F::34de:0e83

2620:108:D00F::343d:39d3

2620:108:D00F::607f:6280

US-GOV-2 IPs

Term Servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: ts01-us-gov-2.cloudsink.crowdstrike.mil

IPs:

139.40.151.40

139.40.151.78

139.40.151.108

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: lfodown01-us-gov-2.cloudsink.crowdstrike.mil

IPs:

139.40.151.46

139.40.151.91

139.40.151.101

Falcon console
Public DNS Name: falcon.us-gov-2.crowdstrike.mil

IPs:

139.40.152.88

139.40.152.38

139.40.152.118
OAuth2-based API IPs

OAuth2-based APIs public DNS

For the US-GOV-2 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
api.us-gov-2.crowdstrike.mil

Event Streams API

Public DNS Name: firehose.us-gov-2.crowdstrike.mil

IPs:

139.40.152.70

139.40.152.40

139.40.152.106

EU-1 IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: ts01-lanner-lion.cloudsink.net

IPs:

3.121.6.180

3.121.187.176

3.121.238.86

3.125.15.130

18.158.187.80

18.198.53.88

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name: lfodown01-lanner-lion.cloudsink.net

IPs:

3.78.32.129

3.121.13.180

3.123.240.202

18.184.114.155

18.194.8.224

35.156.219.65

LFO upload
 Public DNS Name: lfoup01-lanner-lion.cloudsink.net

IPs:

3.69.184.79

3.76.143.53

3.77.82.22

Falcon console
Public DNS Names:

https://falcon.eu-1.crowdstrike.com

https://assets.falcon.eu-1.crowdstrike.com

https://assets-public.falcon.eu-1.crowdstrike.com

IPs:

3.121.13.180

18.184.114.155

18.194.8.224

18.197.35.253

3.122.135.178

18.194.222.197

OAuth2-based API IPs

OAuth2-based APIs public DNS

For the EU-1 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
api.eu-1.crowdstrike.com

Event Streams API

Public DNS Name: https://firehose.eu-1.crowdstrike.com

IPs:

3.121.28.37

18.196.94.202

52.29.26.172

Falcon Forensics
Falcon Forensics [/documentation/page/b9f34543/falcon-forensics-for-windows] requires internet access between hosts in your environment and appointed
CrowdStrike upload servers. Each server corresponds to your target cloud environment (for example US-1, US-2, or EU-1).
Domains:

ffc.us-1.crowdstrike.com (Windows)

52.52.60.244

54.193.196.61

ffcng.us-1.crowdstrike.com (macOS, Linux)

 54.219.198.50

54.219.239.208

ffc.us-2.crowdstrike.com (Windows)

44.241.254.47

54.69.20.169

54.188.85.187

ffcng.us-2.crowdstrike.com (macOS, Linux)

44.230.17.220

52.43.173.253

54.70.55.71

ffc.laggar.gcw.crowdstrike.com (Windows)

15.200.14.201

96.127.77.135

160.1.78.140

2600:1f12:94c:ca02:6c1:7a94:6790:6665

2600:1f12:94c:ca00:7e03:7a1a:40d4:f174

2600:1f12:94c:ca01:f5e1:2977:e9c8:660d

ffcng.laggar.gcw.crowdstrike.com (macOS, Linux)

3.30.22.105

15.200.47.121

15.205.71.244

2600:1f12:94c:ca01:f9a2:fab9:3a16:5b49

2600:1f12:94c:ca02:6e80:c441:827b:c350

2600:1f12:94c:ca00:cb14:c2aa:d3c9:129f

ffc.us-gov-2.crowdstrike.com (Windows)

3.30.59.34

3.30.72.251

15.205.182.88

2600:1f12:40c:8a00:5a5a:21a2:7bce:220c

2600:1f12:40c:8a02:3405:c081:5a7b:c7b6

2600:1f12:40c:8a01:dbdf:f9e7:c9aa:30a6

ffcng.us-gov-2.crowdstrike.com (macOS, Linux)

3.32.103.212

15.205.117.102

15.205.245.124

2600:1f12:40c:8a00:f2e0:319d:14af:af9

2600:1f12:40c:8a01:1bc9:375:3e65:1411

2600:1f12:40c:8a02:392d:baec:284f:da34

ffc.eu-1.crowdstrike.com (Windows)
 3.64.81.130

3.127.43.50

18.193.144.218

ffcng.eu-1.crowdstrike.com (macOS, Linux)

3.69.129.49

3.123.89.179

3.126.96.195

Image assessment IP addresses

To scan images from an on-premises registry, such as Artifactory, or a registry in a private cloud, you must add these IP addresses to the allowlist:

CrowdStrike cloud US-1 US-2 EU-1 US-GOV-1

35.160.117.193 3.73.169.253 52.61.72.154

13.52.148.107
IP addresses 52.43.192.139 18.158.141.230 96.127.111.33
52.52.20.134
54.187.226.134 18.195.129.87 96.127.56.206

Sensor Update Policies [/documentation/page/d2d629cf/sensor-update-policies]