Found out the IP: it's datreputation.mcafee.com.
The follwing FAQ does mention that URL.
But I am using v3 DATs with ENS 10.2. And within Threat Prevention --> Options, the following setting is disabled:
Proactive Data Analysis
Check AMCore Content before installation:
AMCore Content Reputation
So, why is it using DAT Reputation even when it's turned off?
GTI and Dat Reputation are two different things - the DAT Reputation service is used to ensure that only good DAT's are used.
Yes, but I need both turned OFF.
Looks like the "Safety Pulse" Option was still enabled on the client despite that the GTI Feedback Option was turned off.
Safety Pulse depends on GTI feedback and is hidden within the GUI if GTI was disabled. Even then it might be "checked", but you do not see the option.
After removing all the ticks within the GUI, I do not see any "calling home" events on our core firewall.