IPv6 abuse tracking should aggregate by /64 subnet, not single addresses

In IPv6, one subscriber can control a /64 or larger block, and devices with privacy addresses rotate their source addresses frequently. Logging each IPv6 address as a separate client therefore overcounts machines and hides abuse patterns. The article recommends keeping full addresses in raw logs while deriving /64 or wider aggregates for analysis, and widening the unit when an attacker moves between subnets. It also explains normalising address formats, such as RFC 5952 canonical form, to enable accurate matching. Finally, it covers finding the correct abuse contact through the most specific RDAP or WHOIS record.