Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    China- The first country to scan my IPv6 range.!!

    Scheduled Pinned Locked Moved
    General pfSense Questions
    9
    12
    1.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dylanpiergies
      last edited by

      I'm seeing loads of this as well. More from 240e:f7:4f01:c::2 than 240e:f7:4f01:c::3 overall.Screenshot_20200208_213028.png
      It's an interesting scan. I've only got 3 months data, though. Sounds like it's been going on for a while.

      Sergei_ShablovskyS 2 Replies Last reply Reply Quote 0
      • Sergei_ShablovskyS
        Sergei_Shablovsky @dylanpiergies
        last edited by

        @dylanpiergies said in China- The first country to scan my IPv6 range.!!:

        I'm seeing loads of this as well. More from 240e:f7:4f01:c::2 than 240e:f7:4f01:c::3 overall.Screenshot_20200208_213028.png
        It's an interesting scan. I've only got 3 months data, though. Sounds like it's been going on for a while.
        What You are using to build this picture?

        —
        CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
        Help Ukraine to resist, save civilians people’s lives !
        (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

        1 Reply Last reply Reply Quote 0
        • Sergei_ShablovskyS
          Sergei_Shablovsky @dylanpiergies
          last edited by

          @dylanpiergies What You are using to build this picture?

          —
          CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
          Help Ukraine to resist, save civilians people’s lives !
          (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

          D 1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad
            last edited by

            @Sergei_Shablovsky said in China- The first country to scan my IPv6 range.!!:

            What You are using to build this picture?

            https://blog.polleverywhere.com/best-word-cloud-generator/

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              I don't see much ipv6 noise either... But I do see this IP quite a bit in the current logs

              2001:4ca0:108:42:0:80:6:9

              ipv6proves.jpg

              I don't see a pattern to their search..

              Probing 80 on random IPv6 in my ranges..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • D
                dylanpiergies @Sergei_Shablovsky
                last edited by

                @Sergei_Shablovsky It's a tag cloud in Kibana. Firewall logs are being sent to ElasticSearch.

                1 Reply Last reply Reply Quote 0
                • M
                  marksin Banned
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • M
                    maverick_slo
                    last edited by

                    Last 60 days :)
                    e9c899f7-0ddc-45da-b3a9-8f259e80810b-image.png

                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan
                      last edited by

                      Using the latest fail2ban so its IPv6 aware on a Debian web/mail/dns/whatever server.
                      IPv6 isn't background noise any-more. 10 % and raising.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • P
                        pooperman
                        last edited by

                        I find this post absolutely hilarious.
                        I haven't done squat with ipv6 for about the last 10 years ... and not that I needed it now I have decided that as an experiment I will provide some v6 connectivity to some of my LAN hosts cause I have a /48 from my ISP.

                        I was actually debugging some network issues related to NDP so was running a tcpdump on my link... as soon as my subnet become routable massive portscanning traffic started flowing in from the exact same ip:

                        240e:f7:4f01:c::3.53802

                        I find this absolutely hilarious cos this was one of the selling point of IPv6, kind of a "security through obscurity" that you cannot ( or I mean you should not be THAT DUMB TO TRY) scan address ranges and this guy is not giving up since 2 years, imagine the amount of junk traffic he generated since than and just how many ips is he scanning bruh don't have anything better to do? :D

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.