The lesson here, I think, is that security intuitions developed in an IPv4 world with NAT everywhere may need re-examining in an IPv6 world.<p>If your device has a publicly routable IP address, it should probably be behind a firewall.  If it&#x27;s not behind a firewall, it&#x27;s going to get scanned.  Relying on security through address space size is stupid.<p>&gt; What was most puzzling was the fact that the devices that were targeted had randomized IPv6 addresses and were not published in DNS or any public record. For all intents and purposes they were hidden safely within my lab network.<p>That is just wrong, and it&#x27;s wrong in a very glaring, obvious way:  The devices were not &quot;hidden safely within [his] lab network&quot;, because he was not using NAT.  They were connected to the internet with publicly routable IP addresses, which they were using to communicate with other hosts on the internet.<p>Edit:  That being said, it&#x27;s a great writeup, and some good technical work was done to figure out what was going on, and I enjoyed reading it.  But the starting premise seemed to be &quot;how could this be happening, my devices are hidden!&quot; and I feel like it should have been &quot;oh, it makes sense that someone would do this since my devices are no longer hidden&quot;.