Aside from Shodan's neat trick of infiltrating the NTP pool, are there any papers/blogs on successfully exploiting known properties of IPv6 (network prefixes, MAC vendors etc)? However I think about it it seems too massive
I was mostly thinking about the sparse structure of upper bits (which are easily enumerable e.g. by downloading a RIPE database dump). As for the lower 64, MAC address OUIs contribute at most around 15 bits, and the distribution is likely strongly skewed towards only a handful of vendors, so actual randomness is probably lower still.