Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    China- The first country to scan my IPv6 range.!!

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 9 Posters 2.2k Views 10 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I Offline
      iguanagomes
      last edited by stephenw10

      Very rarely do I see port probes on IPv6, in fact, in nearly 10 years barely any that wasn't me initiating it. [spam link removed]

      But then I see a host in 240e::/18 range scanning one of my /64's. Like, LOTS and LOTS
      of them. Random IP's being hit in that /64 looking for VNC/Spice (5901). Heads up, China, nothing is open on that /64.

      I love IPv6, makes it easier to block an entire country or ISP, or end user. All those quintillion+ of IP's are now perpetually blocked.

      Easy Rule Block to the rescue!

      Kinda futile to scan a /64, it makes WAY too much noise!

      Should I be surprised this is actually the first lot of IPv6 I've also blocked in 10 years.... 🙄

      1 Reply Last reply Reply Quote 0
      • NogBadTheBadN Offline
        NogBadTheBad
        last edited by NogBadTheBad

        @iguanagomes said in China- The first country to scan my IPv6 range.!!:

        hen I see a host in 240e::/18 range scanning one of my /64's. Like, LOTS and LOTS of them. Random IP's being hit in that /64 looking for VNC/Spice (5901). Heads up, China, nothing is open on that /64.
        I love IPv6, makes it easier to block an entire country or ISP, or end user. All those quintillion+ of IP's are now perpetually blocked.
        Easy Rule Block to the rescue!
        Kinda futile to scan a /64, it makes WAY too much noise!
        Should I be surprised this is actually the first lot of IPv6 I've also blocked in 10 years....

        Use pfBlocker and block the whole of China by GeoIP ☺

        I've had 240e:f7:4f01:c::3 knocking on my /64 door for weeks now.

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        1 Reply Last reply Reply Quote 0
        • D Offline
          dylanpiergies
          last edited by

          I'm seeing loads of this as well. More from 240e:f7:4f01:c::2 than 240e:f7:4f01:c::3 overall.Screenshot_20200208_213028.png
          It's an interesting scan. I've only got 3 months data, though. Sounds like it's been going on for a while.

          Sergei_ShablovskyS 2 Replies Last reply Reply Quote 0
          • Sergei_ShablovskyS Offline
            Sergei_Shablovsky @dylanpiergies
            last edited by

            @dylanpiergies said in China- The first country to scan my IPv6 range.!!:

            I'm seeing loads of this as well. More from 240e:f7:4f01:c::2 than 240e:f7:4f01:c::3 overall.Screenshot_20200208_213028.png
            It's an interesting scan. I've only got 3 months data, though. Sounds like it's been going on for a while.
            What You are using to build this picture?

            —
            CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
            Help Ukraine to resist, save civilians people’s lives !
            (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

            1 Reply Last reply Reply Quote 0
            • Sergei_ShablovskyS Offline
              Sergei_Shablovsky @dylanpiergies
              last edited by

              @dylanpiergies What You are using to build this picture?

              —
              CLOSE SKY FOR UKRAINE https://youtu.be/_tU1i8VAdCo !
              Help Ukraine to resist, save civilians people’s lives !
              (Take an active part in public protests, push on Your country’s politics, congressmans, mass media, leaders of opinion.)

              D 1 Reply Last reply Reply Quote 0
              • NogBadTheBadN Offline
                NogBadTheBad
                last edited by

                @Sergei_Shablovsky said in China- The first country to scan my IPv6 range.!!:

                What You are using to build this picture?

                https://blog.polleverywhere.com/best-word-cloud-generator/

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                1 Reply Last reply Reply Quote 0
                • johnpozJ Offline
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  I don't see much ipv6 noise either... But I do see this IP quite a bit in the current logs

                  2001:4ca0:108:42:0:80:6:9

                  ipv6proves.jpg

                  I don't see a pattern to their search..

                  Probing 80 on random IPv6 in my ranges..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • D Offline
                    dylanpiergies @Sergei_Shablovsky
                    last edited by

                    @Sergei_Shablovsky It's a tag cloud in Kibana. Firewall logs are being sent to ElasticSearch.

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      marksin Banned
                      last edited by

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • M Offline
                        maverick_slo
                        last edited by

                        Last 60 days :)
                        e9c899f7-0ddc-45da-b3a9-8f259e80810b-image.png

                        1 Reply Last reply Reply Quote 0
                        • GertjanG Offline
                          Gertjan
                          last edited by

                          Using the latest fail2ban so its IPv6 aware on a Debian web/mail/dns/whatever server.
                          IPv6 isn't background noise any-more. 10 % and raising.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • P Offline
                            pooperman
                            last edited by

                            I find this post absolutely hilarious.
                            I haven't done squat with ipv6 for about the last 10 years ... and not that I needed it now I have decided that as an experiment I will provide some v6 connectivity to some of my LAN hosts cause I have a /48 from my ISP.

                            I was actually debugging some network issues related to NDP so was running a tcpdump on my link... as soon as my subnet become routable massive portscanning traffic started flowing in from the exact same ip:

                            240e:f7:4f01:c::3.53802

                            I find this absolutely hilarious cos this was one of the selling point of IPv6, kind of a "security through obscurity" that you cannot ( or I mean you should not be THAT DUMB TO TRY) scan address ranges and this guy is not giving up since 2 years, imagine the amount of junk traffic he generated since than and just how many ips is he scanning bruh don't have anything better to do? :D

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.