I'm seeing the following IPv6 addresses having requests dropped by our firewall. It doesn't seem to be anything too malicious, but there seems to be a strange pattern to them:
2aab:19a7:3971:94f4::80fe (62,050 requests) bb2d:f96b:f097:bccd::80fe (31,392 requests) aafb:2bc8:ccad:1451::80fe (26,400 requests) be2b:2477:43c2:4447::80fe (21,754 requests)
That's just over the last 7 days. There are more, but the pattern is basically the same - they all end in ::80fe
. Which makes me wonder if it was some sort of lame attempt into fooling me into thinking it's an fe80::
address (which to be honest, I almost fell for).
Has anyone else with IPv6 connectivity seen anything like this? I'm assuming it's some sort of port scan, but IPv6 was meant to make random port scanning a thing of the past (given the sheer size of IPv6)