@encthenet I'll support you on this if you want them to rescind the SA. I think labeling it as an SA caused the remediation to be rushed. And every time I think about it, it's like "okay so they gotta be on the same broadcast domain to send you an ND packet, and then ping following to hopefully get a response confirming it exists? But this would never work to scan the entire IPv6 address space and the threat is already on your network you control or is your ISP's modem/router?"