Xplora Technologies AS — E8:BA:E2 (MA-L)

E8:BA:E2 is a single MA-L (24-bit OUI) block assigned by the IEEE to Xplora Technologies AS, a Norwegian company registered at Nedre Slottsgate 8, Oslo, NO 0157. Xplora builds children's GPS smartwatches and watch-phones — current lines are the XGO3 (marketed for ages 4–7) and the X6Play (ages 7–12), succeeding earlier Xplora 4/X5 models. These are 4G/LTE cellular devices with a built-in SIM and their own phone number; WiFi appears on at least some models (used for over-the-air firmware updates) and GPS provides location. By design the watches block open internet access and route everything through parental controls — the use-case is location tracking, SOS calls, and supervised messaging for children, not general-purpose computing. The block spans E8:BA:E2:00:00:00 – E8:BA:E2:FF:FF:FF. This OUI carries real security weight: the product line has a documented history of serious incidents. In 2020, mnemonic.io researchers found a deliberate SMS-triggered backdoor in the Xplora 4 (hardware built by China's Qihoo 360) capable of remote photo capture, audio recording, and location exfiltration; Xplora shipped a patch that October. At the 39C3 conference (2024/2025), researchers disclosed three further critical flaws in current models — hardcoded static authentication keys allowing valid API keys to be derived from public data, PIN-brute-forceable USB debug access via a special charger, and API weaknesses permitting message read/write, fake GPS injection, and remote device reset — affecting an estimated 1.5 million+ devices. Seeing this prefix on a network is worth scrutiny: it marks a child-tracking wearable, not commodity infrastructure.

IEEE assignment

E8:BA:E2 → Xplora Technologies AS [Confirmed] — IEEE oui.csv (enrichment/registries/oui.csv), maclookup.app (https://maclookup.app/macaddress/E8BAE2/mac-address-details)

Registry / block size

MA-L (24-bit OUI); single block covering E8:BA:E2:00:00:00 – E8:BA:E2:FF:FF:FF (~16.7M addresses). Universally Administered Address (UAA), unicast. [Confirmed] — IEEE oui.csv; not present in mam.csv (MA-M) or oui36.csv (MA-S). NOTE: IEEE publishes NO assignment/registration date — oui.csv columns are only Registry, Assignment, Organization Name, Organization Address; any third-party "date registered" is a database artifact, not an IEEE fact.

HQ / country

Nedre Slottsgate 8, Oslo, NO 0157, Norway [Confirmed] — IEEE oui.csv (registry address); country also corroborated by reporting (https://securityboulevard.com/2020/10/xplora-watches-for-kids-chinese-spyware/)

Vendor short name / Wireshark label

"Xplora" / "XploraTechno" [Confirmed] — maclookup.app (https://maclookup.app/macaddress/E8BAE2/mac-address-details)

Company status

active [Confirmed] — shop.myxplora.com (https://shop.myxplora.com/)

Device types

children's GPS smartwatch / watch-phone. Current lines XGO3 (ages 4–7) and X6Play (ages 7–12); earlier Xplora 4/X5. [Confirmed] — official product pages (https://shop.myxplora.com/products/xgo3, https://shop.myxplora.com/products/x6play, https://xplora.co.uk/pages/x6play-and-xgo3-product-specifications)

Connectivity

primary 4G/LTE cellular with built-in SIM and own phone number; WiFi on at least some models for OTA firmware updates; GPS. No open internet access by design (parental controls). Prior Xplora 4 used 3G/4G with SIM. [Confirmed] — Xplora compare page (https://shop.myxplora.com/pages/compare), whatgadget review (https://www.whatgadget.net/xplora-xgo3-childs-gps-smartwatch-review/)

Security context — HIGH RELEVANCE, two documented incidents

Allocated date

Unknown [Unknown] — IEEE publishes no OUI/MA-L registration dates; no first-party date source available (not fabricated)

Website

https://shop.myxplora.com (US), https://xplora.co.uk (UK); xplora.com redirects to shop.myxplora.com [Confirmed] — https://shop.myxplora.com/

Analyst note

a globally-administered E8:BA:E2 address reliably identifies genuine Xplora children's-watch hardware. Given the device class (child location/audio) and the documented backdoor + 39C3 flaws, this prefix appearing on a managed network warrants review — treat as a consumer wearable with a notable security history, not infrastructure.