Maybe not that many, but still a lot more, if you first looked at BGP, and only brute-forced networks that were routable, rather than the entire search space.

Basically, before scanning, query and iterate all ASes advertisments and union present ranges, then feed that to zmap or something that can scan IPv4 and/or IPv6.

I dunno how I messed that up. I'mma blame the post-lunch slump. For some reason I was thinking IPv6 was 64 bits.