Most IPv6 subnets are no smaller than /64
. It's not a protocol requirement, but it is de facto standard and also necessary for networks that run SLAAC.
Each of those networks contains 18446744073709551616 IP addresses, and, in each network, only a handful of those addresses will ever be used.
Therefore, even if you know exactly what subnets are assigned and which are unassigned, it's infeasible to scan even a single IPv6 subnet to find the host addresses that are in use inside that subnet. So making it hard to guess which subnets are assigned doesn't really help.
Put that together with the fact that even if ISPs must move their address blocks around from time to time, they must still document their assignments in WHOIS so that outsiders can find out who is responsible for a given IP address and contact the right abuse desk. We intentionally do the opposite of hiding IP network assignments!
Exceptions: if you guess an IPv6 subnet that is in use, you actually have better than 1/18446744073709551616 chance of finding an assigned IP address within that subnet. For example, if SLAAC is in use and who can guess the MAC address of a host on the subnet, you can generate its IP address. Privacy addresses mitigate this. Also, servers will often have well known, simple addresses like <subnet>::1
so you can guess those too (but then again, they're servers, so they're supposed to have well known addresses). Still, it's sufficiently daunting that I think it's still a futile task to try to "portscan" IPv6.