TOZO INC — 2 prefixes (MA-L)

TOZO INC holds two IEEE MA-L blocks — 58:FC:C6 and 94:4B:F8 — both registered to the same Seattle, Washington address (1546 NW 56th St # 743, Seattle WA 98107-5209), giving the vendor roughly 33.6 million addresses across two 24-bit OUIs. TOZO is a US consumer-electronics brand founded in June 2015 by Ryel Lin, whose product line is overwhelmingly Bluetooth audio: true wireless stereo (TWS) earbuds, noise-canceling earbuds, over-ear and open-ear headphones, Bluetooth speakers, plus smartwatches, wireless chargers, and power banks. Devices bearing these prefixes will be consumer Bluetooth peripherals, not networking infrastructure, which matters for asset classification — a TOZO OUI on a network almost always means an earbud or headphone radio, not a managed device. Two practical caveats apply. First, IEEE publishes NO assignment dates in its OUI registry, so the "2021-09-13" and "2024-02-01" dates shown by third-party lookups are database artifacts (when the prefix first appeared in an IEEE list snapshot), not IEEE-attested registration dates, and must not be presented as such. Second, on the security side, the TOZO NC2 model was reported vulnerable to the 2025 "Stealtooth" Bluetooth attack (a silent automatic-pairing link-key overwrite), one of eight of ten tested devices compromised — a proximity-based class issue worth noting wherever TOZO devices are inventoried, though no TOZO-specific CVE has been assigned.

IEEE assignment

2 prefixes → TOZO INC, registered Seattle, WA, US [Confirmed] — IEEE MA-L (enrichment/registries/oui.csv lines 771, 38320)

Verified prefixes (both MA-L, TOZO INC)

58:FC:C6, 94:4B:F8 [Confirmed] — IEEE oui.csv / maclookup.app

Registry / block size

MA-L (24-bit OUI); 2 IEEE prefixes (~33.6M addresses total, ~16.7M each) [Confirmed] — IEEE MA-L. NOTE: IEEE's public OUI data publishes NO assignment/registration date; the "2021-09-13" (58:FC:C6) and "2024-02-01" (94:4B:F8) values on maclookup.app are third-party database artifacts, not IEEE facts. [Likely as snapshot dates] — https://maclookup.app/vendors/tozo-inc

No MA-M / MA-S blocks

no TOZO entries in mam.csv (MA-M) or oui36.csv (MA-S) [Confirmed] — enrichment/registries scan

HQ / country

1546 NW 56th St # 743, Seattle, WA 98107-5209, US (registry address); headquarters Seattle, Washington, US [Confirmed] — IEEE MA-L; https://en.wikipedia.org/wiki/TOZO, https://www.tozostore.com/pages/our-story

Company status

active [Confirmed] — https://www.tozostore.com/

Founded

June 2015 [Confirmed] — https://en.wikipedia.org/wiki/TOZO

Founder

Ryel Lin [Confirmed] — https://en.wikipedia.org/wiki/TOZO

Device types

Bluetooth TWS earbuds, noise-canceling earbuds, over-ear/open-ear headphones, Bluetooth speakers, smartwatches, wireless chargers, power banks; AR glasses (VIZO V1/Z1, 2026). Primary category is Bluetooth TWS earbuds. [Confirmed] — https://en.wikipedia.org/wiki/TOZO, https://www.tozostore.com/pages/our-story, https://buy.tozostore.com/about

Market scale

30M+ users, 20M+ units sold globally as of December 2024, sold in 50+ countries, 200+ product patents [Confirmed] — https://www.tozostore.com/pages/our-story

Bluetooth chip context

TOZO NC2 reported to use an Airoha AB1562A Bluetooth audio SoC (third-party teardown); chip vendor for other models not confirmed [Likely] — https://www.qucox.com/tozo-nc7-earbuds-teardown/

Security context

TOZO NC2 reported vulnerable to "Stealtooth" (silent BLE auto-pairing link-key overwrite; arxiv 2507.00847, 2025); 8 of 10 tested devices vulnerable. Proximity-based, no user notification. No TOZO-specific CVE assigned; Airoha class-level CVE-2025-20700/20701/20702 affect many TWS brands, not TOZO-specifically. [Confirmed] — https://arxiv.org/html/2507.00847v1, https://cyberinsider.com/exploit-tool-for-bluetooth-flaws-impacting-millions-of-headphones-now-available/

IANA Reference

Unknown — no applicable IANA RFC reference for this OUI/vendor entry [Confirmed] — n/a

Analyst note

A TOZO OUI on a network identifies a consumer Bluetooth audio device (earbuds/headphones/speaker), never networking infrastructure. Do not present third-party lookup dates as IEEE registration dates.