Evaluating Attacks on IPv6 Devices Using Honeypots: A Preliminary Analysis

This work in progress aims to understand the sources and motives of attackers in the context of the IPv6 protocol. To achieve this, we built an IPv6 honeypot infrastructure with 15 machines to attract and analyze attacker behavior. Some addresses were disclosed using Shodan, Censys, and surface/dark web forums. We observed 106 connection attempts originating from 52 different IP addresses and 5 ISPs across the US, China, South Korea, and Singapore. Our preliminary results indicate that targeting IPv6 devices in the wild remains challenging, even with various disclosure methods.