I'm really surprised shady figures aren't publishing lists of active IPv6 addresses to allow scanning.

For example, someone with access to a backbone internet router could easily log src and destination ipv6 addresses, and sell the complete list sorted and compressed. Malware authors could then use the list to portscan for badly firewalled stuff.