All our servers are currently hosted on Amazon AWS eu-west-1 in Ireland and access stylesheets over HTTPS. Below is a list of the IPs Hotjar uses to send egress, outgoing, traffic from which you can allow if required on your end.
18.203.61.76
18.203.176.135
52.17.197.221
The IPs listed above do not cover the actual domain
The actual domain is https://insights.hotjar.com. This is due to it being served by our CDN provider. We suggest allowing the domains *.hotjar.com especially for applying CSS to Heatmaps. This is not needed for CSS in Recordings.
It may be required for you to allow our browser userAgents as well. If that is the case, head to How do Hotjar Heatmaps work?: A Technical Explanation for the full list of our browser userAgents.