> Shodan has servers located around the world that crawl the Internet 24/7 to provide the latest Internet intelligence.
That needs to sink in for anyone ever allowing themselves to believe the fallacy that they can slip under the radar with a security vulnerability or sleeping soundly with security by obfuscation. You aren't a computer port hiding on one specific computer on the internet, you are data trying to hide in a relational database.
Depends on what you mean by "a reasonable percentage" there.
If you can scan all of 2^32 addresses in IPv4 in ~5mins (as suggested elsewhere in this thread), then it'd take something like 75,000,000,000,000,000,000,000 years to do the same for all 2^128 addresses in IPv6.
It's possible you've got a technique to find "a reasonable percentage" of all devices listening/responding on IPv6 addresses, but unless 10^-22% is "a reasonable percentage" - then no, you can't randomly portscan IPv6 and ever even realistically expect to connect to anything at all, never mind come up with some Shonan-Like map of almost the entire address space.
This mostly just moves the problem from brute forcing into dictionary attacks though, similar to how passwords get mostly attacked these days. Any IPv6 address that's doing anything on the internet leaves traces of it's existence/activity somewhere. I'm guessing there are people popping log files and monitoring major traffic interchanges, and creating their own haveibeenpwned-style lists of IPv6 addresses that're actually in use, then selectively scanning them and probably the closely related subnets of them. If your "promising methods of host discovery" extend radially beyond that, I'd be super interested if you're prepared to share them?
Almost all machines are dual homed, which gives you opportunities for them to leak their v6 address over v4. Once you find a statistically significant sample of addresses you can figure out how each network allocates addresses and then scan them until you start turning up no new hits. For example on my v6 blocks I just use the same last octet as their v4 addresses.
So e.g. you can see that the answer for www.google.com was 2a00:1450:4009:81a::2004 for somebody at about 0200 UTC today, but the people providing this data don't provide (and in some cases may not know or be contractually obligated never to tell) "who" asked that question and got that answer.
So this is pretty useful if you're trying to figure out which DNS names exist (as a startup I worked for were doing) and if they have AAAA record then you get all those records.
If you've got a deliberately public IPv6 server it's very likely it can be found by this sort of method.
Do your maths again though. The smallest allowed conventional subnet in IPv6 is 64 bits wide. So surveying "closely related subnets" is 4 billion times more work than surveying the entire IPv4 Internet.
If there's a machine with IPv6 privacy addressing on a "closely related subnet" you're just never going to find it by brute force.
There might also be an answer in public material from Paul Vixie or Geoff Huston if you are inclined to find out.
We know the address space already. The approach was for finding used ones.