Security researchers have detected a massive reconnaissance campaign targeting artificial intelligence infrastructure, with over 91,000 attack sessions recorded between October 2025 and January 2026.
The attacks reveal how threat actors are systematically mapping vulnerabilities in AI deployments.
GreyNoise’s Ollama honeypot infrastructure captured two distinct campaigns that expose critical security gaps in LLM implementations.
The findings corroborate research from Defused and have prompted GreyNoise to issue an Executive Situation Report to customers.
SSRF Campaign Targets AI Infrastructure
The first campaign exploited server-side request forgery vulnerabilities to force servers into making outbound connections to attacker-controlled infrastructure.
Attackers targeted Ollama’s model pull functionality by injecting malicious registry URLs and manipulated Twilio SMS webhook integrations through MediaUrl parameters.
The campaign peaked during Christmas 2025, registering 1,688 sessions within 48 hours.
Analysis revealed 99% of attacks shared a single JA4H signature (po11nn060000…), indicating shared automation tooling, likely ProjectDiscovery’s Nuclei.
Despite originating from 62 IPs across 27 countries, consistent fingerprints suggest VPS-based infrastructure rather than botnet activity.
Beginning December 28, 2025, two IP addresses launched methodical probes against 73+ LLM model endpoints, generating 80,469 sessions over eleven days.
The reconnaissance targeted misconfigured proxy servers that could leak commercial API access.
Model and Prompt Testing Data
| Prompt | Occurrences |
|---|---|
| hi | 32,716 |
| How many states are there in the United States? | 27,778 |
| How many states are there in the United States? What is todays date? What model are you? | 17,979 |
| (empty string) | 8,073 |
| How many letter r are in the word strawberry? | 2,024 |
The attacks tested major model families including OpenAI GPT-4o, Anthropic Claude, Meta Llama 3.x, DeepSeek-R1, Google Gemini, Mistral, Alibaba Qwen, and xAI Grok using innocuous queries designed to avoid triggering security alerts.
Two IPs drove the campaign: 45.88.186.70 (AS210558) with 49,955 sessions and 204.76.203.125 (AS51396) with 30,514 sessions.
Both addresses have extensive histories of CVE exploitation, including CVE-2025-55182 and CVE-2023-1389, with combined observations exceeding 4 million sensor hits.
Security experts recommend organizations lock down model pulls, implement enumeration pattern detection, block OAST domains, and monitor JA4 fingerprints to defend against these sophisticated reconnaissance operations.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
