So I’m doing a packet trace with Wireshark during CLI install. I’ll update this post as I find the sites/ports:
binaries.particle.io (ip addr varies) on TCP port 443 (TLS v1.2)
registry.npmjs.org - DNS lookup/TLS v1.2 Handshake/One data packet
It seems that the installer first goes to binaries.particle.io and downloads a file. Then it does a DNS lookup to registry.npmjs.org and does a quick handshake to that server. I cannot see the packet contents because it is encrypted (TLS v1.2 again). Immediately after the handshke to npmjs.org, it starts another download from binaries.particle.io. Doing the packet trace on several different install sessions, the IP address to binaries.particle.io changed several times. Best to white-list the domain rather than an IP address.