LLM enumeration and SSRF probing: what do teams need to block?

TL;DR: 91,403 attack sessions against its Ollama honeypot between October 2025 and January 2026, according to GreyNoise, including a 80,469-session enumeration campaign and a separate SSRF campaign that used OAST callbacks, shared JA4H fingerprints and trusted model-pull abuse to map exposed AI infrastructure. The pattern shows that AI deployments are becoming reconnaissance targets before they become compromise targets, and access control must start at the edge, not after model exposure.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Threat Actors Actively Targeting LLMs”.

By the numbers:

• The SSRF campaign spiked to 1,688 sessions in 48 hours over Christmas.
• Attackers probed 73+ LLM model endpoints during the enumeration campaign.

Key questions

Q: What breaks when AI platforms allow untrusted model pulls and outbound callbacks?

A: The platform stops acting as a controlled service and starts acting as an outbound relay for attacker-chosen destinations.

Q: Why does large-scale LLM endpoint probing matter before any compromise is visible?

A: Because reconnaissance tells attackers which endpoints exist, which formats are accepted, and which services are worth deeper attention.

Q: How can security teams tell AI probing apart from ordinary user traffic?

A: Look for repeated low-noise requests across many model endpoints, families, or prompt patterns from the same source, especially when the content is deliberately harmless.

Practitioner guidance

• Restrict model pulls to trusted registries Allow AI platforms to fetch models only from approved sources, and block arbitrary registry URLs or unauthorised remote content retrieval.
• Filter outbound traffic for SSRF containment Apply egress rules so that model-pull paths, webhook handlers, and other fetch functions cannot reach attacker-controlled callback infrastructure.
• Detect enumeration across model endpoints Alert when a single source probes multiple AI endpoints, model families, or prompt formats in a short window, even if each request looks harmless.

Bottom line: Attackers are probing AI platforms as a reconnaissance target, not only as a direct compromise target.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →