Based on an idea from a NANOG post I created a script to walk an ip6.arpa zone and list all IPv6 hosts.
It works surprisingly well:
$ ./ip6dnswalk.py 2620:0:1C00::/40
2620:0000:1cfe:face:b00c:0000:0000:0003 www.v6.facebook.com.
2620:0000:1cfe:face:b00c:0000:0000:0004 login.v6.facebook.com.
2620:0000:1cfe:face:b00c:0000:0000:0005 hphotos-sjc1.v6.fbcdn.net.
2620:0000:1cfe:face:b00c:0000:0000:0006 apps.v6.facebook.com.
2620:0000:1cfe:face:b00c:0000:0000:0007 m.v6.facebook.com.
2620:0000:1cfe:face:b00c:0000:0000:0008 register.v6.facebook.com.
2620:0000:1cfe:face:b00c:0000:0000:0009 check6.v6.facebook.com.
2620:0000:1cff:dead:beef:0000:0000:0000 pr01.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0001 pr02.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0002 bb01.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0003 bb02.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0004 pr02.pao1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0005 pr03.pao1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0006 bb01.pao1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0007 bb02.pao1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0008 ae0.pr01.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:0009 ae0.bb01.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:000c ae4.bb01.sjc1.tfbnw.net.
2620:0000:1cff:dead:beef:0000:0000:000d ae2.bb01.pao1.tfbnw.net.
More details and a method of preventing this are in my ip6walk git repository.
