Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the

Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent). Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.