Insights into the IPv6 scanning landscape: An extended study using passive darknets and responsive honeynets with prefix exposing techniques

Internet-wide scanning is essential for collecting network information but also serves as the first step of cyberattacks. In contrast to IPv4, the vast and sparsely populated IPv6 address space makes exhaustive scanning impractical. Instead, IPv6 scanners use hitlist and target generation methods to obtain potential targets. This paper presents a comprehensive study of IPv6 scanning activities, focusing on how fresh IPv6 prefixes are discovered and exploited by scanners. To investigate these scanning activities, we deployed multiple darknets and honeynets, combined with four DNS-based address exposure methods, to attract the scanners' attention. Over an 18-month period, we collected 107.6 million scanning sessions from 23,199 unique source IP addresses across 170 ASes. The exposed addresses were quickly discovered by DNS scanners and added to hitlist, resulting in a substantial number of scans. The majority of the scans target the IPv6 addresses associated with IPv4, while IPv6-only DNS records largely remain hidden. This suggests that using IPv6 only for DNS without associating with IPv4 can help maintain anonymity. In addition, our analysis reveals the discovery process of fresh IPv6 prefixes, from target discovery, probing, hitlist registration to large-scale follow-up scans. The responsive addresses in the honeynet attract significant scans compared to the darknet. We categorize the scanners into three types based on their scan preferences. Finally, we analyze the intentions of scanners based on their scanning scale and behavioral patterns, including reconnaissance scans, volumetric and application-layer attacks. We also compare IPv6 scanning behavior with that observed in an IPv4 darknet. These findings shed light on the IPv6 scanning activities, offering insights to enhance IPv6 network security.