This page lists:
This information is provided for informational and configuration purposes only. It is not a service specification, guarantee, or service-level commitment.
Addresses and URLs may change as Coro’s infrastructure evolves. Coro will provide advance notice on this page before retiring an address or URL.
Review this page regularly to keep your configuration up to date, and see the change history for a record of recent updates.
Last verified: August 12, 2026
This section lists the outbound source IP addresses currently used by Coro platform services and Coro Email Protection.
Use them to allowlist traffic originating from Coro, including in Microsoft Entra Conditional Access Named Locations.
These are outbound NAT addresses only. Do not use them as destinations for the Coro console, APIs, agents, or other Coro services; use the documented DNS names instead.
Make sure to allowlist all IP addresses listed for your subscription region. Do not separate or select individual addresses.
These outbound source IP addresses are used by Coro platform services:
13.58.27.87
18.220.239.37
3.130.81.108
18.221.164.171
3.136.131.248
3.137.77.197
13.58.188.55
3.12.180.190
3.13.6.1983.73.113.128
18.153.173.131
18.195.135.23199.79.28.168
3.97.100.165
15.156.223.65These additional IP addresses relate to mailbox and message scanning, and are only required if you need to allowlist Coro's connections to a mail service (Microsoft 365, Google Workspace, third-party mail gateway):
3.20.108.11
18.116.1.241
18.119.81.75
3.137.39.96
3.150.11.139
18.188.35.30
3.132.194.247
18.119.46.107
18.218.235.172
3.133.78.122
3.137.103.88
3.12.194.141
18.118.203.62
18.218.250.155
3.138.66.9463.178.186.72
18.156.32.119
18.153.127.58
18.198.225.203
63.176.248.217
52.57.15.7452.60.210.158
99.79.173.138
15.156.141.12
99.79.177.145
16.52.24.11
15.223.87.76To ensure Coro Agent installation, communication, detections, and updates function correctly, allow outbound access to the following Coro service endpoints in your firewall settings.
https://cdn-ai-malware.infra.coro.netUse the URL that matches your subscription’s data-residency region:
- United States:
https://online-server.secure.coro.net - European Union:
https://online-server.secure-eu.coro.net - Canada:
https://online-server.secure-ca.coro.net
https://d1dvi2i8pgh0hk.cloudfront.nethttps://s3.amazonaws.com/client-repo.coro.netNo changes.