• IPv6 scanning has often been compared to finding needles in an impossibly large haystack. • With an address space of 2128, blindly sweeping the entire IPv6 Internet is practically infeasible. • Instead, IPv6 scanners must cleverly choose their targets using hints like active address lists, Domain Name System (DNS) records, or routing announcements. • For network defenders and researchers, this raises a challenge: How do we observe and analyse IPv6 scanning when malicious actors could be probing only selective, obscure corners of the address space? • Our work at CoNEXT 2025 rises to this challenge by deploying the largest-ever IPv6 ’network telescope’ and capturing the largest IPv6 scan traffic dataset to date. • The findings paint a striking picture: IPv6 scanning activity has skyrocketed by one hundred times in recent years, and diversified across many more sources.

Article Summaries:

  • IPv6 scanning has often been compared to finding needles in an impossibly large haystack. With an address space of 2128, blindly sweeping the entire IPv6 Internet is practically infeasible. Instead, IPv6 scanners must cleverly choose their targets using hints like active address lists, Domain Name System (DNS) records, or routing announcements. For network defenders and researchers, this raises a challenge: How do we observe and analyse IPv6 scanning when malicious actors could be probing only selective, obscure corners of the address space? Our work at CoNEXT 2025 rises to this challenge by d

Sources: