The Model Hunters: Seventy-Four Addresses Came for the GPU and Left With Nothing

Every letter in this series so far has counted people looking for something this estate does not have. Credential files it never wrote. Hostnames it never registered. Webshells nobody planted.

This one is different. This letter is about seventy-four addresses that came looking for something that is actually here.

Behind this edge, right now:

Between 2026-06-05 and 2026-08-09, 74 distinct addresses made 385 requests hunting for exactly that. They asked the right questions of an estate that genuinely runs the thing they wanted.

They got nothing. Not one model listing, not once, in the entire corpus.

This is a letter about a negative result, which is an unusual thing to publish and the reason it is worth publishing.

What they were asking for

The path vocabulary is not generic. Every one of these is a specific product's API:

Nobody guesses /ollama/api/tags. That path only exists because OpenWebUI mounts Ollama under a prefix, and knowing it means knowing the deployment pattern — the same one this estate uses.

Ranked by volume across the population:

Why anyone bothers

An exposed Ollama is not an information leak. It is three separate problems, in ascending order of cost.

It enumerates. /api/tags returns the full model inventory. That is reconnaissance: it tells an attacker what this machine is for, how much disk it has, and whether the operator runs anything unusual enough to be worth a second look.

It generates. An open /api/generate or /v1/chat/completions is free inference on somebody else's hardware and somebody else's electricity bill. This has a name now — LLMjacking — and it is the actual business model. A 236-billion-parameter model that costs real money to run anywhere else is, on an open endpoint, free.

It fetches. /api/pull instructs the host to download a model from a registry the caller names. That is a server-side request the attacker controls, aimed at software that then executes what it downloads. It is the most consequential of the three and the least discussed.

This estate's operating notes have carried a line about this for months — an unauthenticated hit on /api/tags enumerates every model, and /api/pull can make a host fetch attacker-controlled content. The classifier's own registry entry for this intent says the same. The concern was documented before the traffic was measured; this letter is the measurement.

They are hunting services, not websites

This is the finding that distinguishes this population from every other one in the series, and it shows up in three independent places.

First, the busiest target is not a hostname. It is the estate's bare public address:

Ninety-eight requests went to raw addresses with no Host header worth the name. Every other population in this census arrived asking for a site. This one arrives asking whether a port answers, because that is how Ollama is found: it binds an address, it does not know it has a domain.

Second, the gRPC reflection probes went nowhere else. Thirty-nine requests from 18 addresses asked ServerReflection/ServerReflectionInfo — the call that makes a gRPC server enumerate its own API. Thirty-one landed on the first bare address, eight on the second, and not one on any hostname. gRPC reflection against a domain would be pointless; against an IP that might be running an inference server, it is the fastest way to find out what it speaks.

Third, the tooling is named and unhidden:

grpcurl is a command-line gRPC client. Nobody ships that string by accident and nobody ships it as disguise — it is what you get when a person runs the tool without thinking about the header. Letter K made the case that a lazy default is a better fingerprint than a crafted one; this is the same principle, one layer down. Two-thirds of this population's requests carry a tool name rather than a browser's.

The company they keep

Hunting a service rather than a site is not new. It is how network appliances have always been found, and this estate's bare addresses have been carrying that traffic all along — a category the census has never opened.

What the other 1,465 are asking for:

Roughly six hundred requests across four path variants hunting Synology's QuickConnect, eighty-seven for a camera SDK, seventy-one for an Argo CD API. Every one of those is the same behaviour as the model hunt: do not ask what site this is, ask what product is listening.

And the same coincidence holds. There is a Synology on this estate. Nobody found it either.

Sorted by what the classifier makes of the senders:

The model hunters are twenty-four of fourteen hundred and eighty-nine — about 1.6% of everyone who has ever addressed this estate by number rather than name. They are not a new phenomenon. They are the newest product category inside an old one, and the only thing that distinguishes them from the people looking for a NAS is which vendor's API path they memorised.

One oddity worth a line because it will otherwise puzzle a future reader: five requests arrived with a Host header of literally 0.0.0.0. That is not an address, it is a placeholder somebody forgot to substitute — a configuration template that shipped with its variable unfilled.

Where they came from

Sixteen of the seventy-four are Alibaba Cloud. This is rented compute scanning for rented compute — no residential proxies, no disposable-address economics, none of the machinery Letters K and L documented. There is no need for it: enumerating an inference endpoint is a handful of requests, and if you find one you do not care that the victim knows where you called from.

What they got

Nothing. This is the whole result and it deserves to be stated without decoration.

Across the entire corpus, no model-enumeration endpoint has ever returned a genuine 200 to anyone. Not /api/tags, not /v1/models, not /ollama/api/tags, not once, from any address, on any host, in seventy days.

The twenty-three successes in that table are worth naming so the figure is not mistaken for a partial win. Five are the site homepage. The other eighteen are WordPress images and blog pages on the personal site — drunken-man-master-300x225.webp, geneza-fb.webp, a page called ultra-femi-niste. The model hunters found a photograph.

And the near miss is where it gets interesting. The closest anyone came was six requests apiece against two hosts:

2026-06-29   mcp.shuffle-on.com          /api/tags  /v1/models  /ollama/api/tags
                                         /system_stats  /gradio_api/info
                                         /api/chat/completions
2026-07-04   lsn-ai-comfyui.shuffle-on.com   (the identical six)

Twelve requests, one probe set fired twice, two weeks apart, at the two hostnames on this estate most likely to be running exactly what the caller wanted. Both were already behind the authentication portal. Every one returned Authelia's login page — which the raw log records as 200, and which this pipeline's mask correction records as the 401 it actually was.

That correction matters here more than anywhere else in the series. Read raw, those twelve requests look like twelve successful hits on an inference API. They were twelve refusals.

The irony, stated plainly

Letters I and J established that this estate was, during precisely this period, leaking something. Two AI services answered HTTP 200 to any invented filename between 2026-06-06 and 2026-07-08 — including fifty-four spellings of cloud credential files — and did not stop until both went behind the portal on 2026-07-10.

So the honest summary of that overlap is uncomfortable and worth writing down:

The scanners hunting credentials asked the wrong hosts the right questions, and were told yes to files that did not exist. The hunters after the GPU asked the right hosts the wrong questions, and were told no to a service that did.

Neither got anything. Only one of those was by design.

What saved the inference endpoints was not vigilance about AI in particular. It was that Ollama sits behind the same forward-auth portal as everything else on this estate, and was never given its own exception. The catch-all defect in Letters I and J was an application behaviour on hosts that were themselves correctly gated; the model API was gated by the same mechanism, and the mechanism held. A single uniform control did the work that no amount of AI-specific worry would have.

The corollary is the uncomfortable half: if any one of those services had ever been given a bypass — a convenience exception for a local script, a temporary rule during a migration — this population would have found it. Nineteen addresses were checking the bare IP for seven distinct paths over two months. They were not going to miss a window.

What this population is not

Two things worth ruling out, because both are tempting and neither is supported.

It is not targeted at this estate. Seventy-four addresses over sixty-six days, most making a handful of requests, from commodity cloud providers, running off-the-shelf tooling with default User-Agents. That is internet-wide sweeping, and this address answered the way every address in the sweep answered. Nothing in the traffic suggests anyone knew what was behind it. The /ollama/api/tags path shows knowledge of a deployment pattern, not of this deployment.

It is not a threat to a closed endpoint. There is no exploit here, no CVE, no attempt at authentication. Every request in this population is a question, and the entire defensive requirement is to not answer it. That is a lower bar than most of what this series has documented, and it is why the result is a clean negative rather than a narrow escape.

What it is: evidence that self-hosted inference has become a standard scan target, on the same footing as phpMyAdmin and .env. Six months ago the intent did not exist in this estate's classifier. It exists now because the traffic did.

What changes here

Nothing, and that is the finding. No control was missing, no rule needs adding, and no address needs banning — 385 requests over sixty-six days from addresses that will not return is not a problem to solve.

Three things are worth keeping rather than doing:

Keep the model API behind the same portal as everything else, and never grant it an exception. The reason this letter is a negative result is that no exception was ever made. The most likely future failure is not an attacker getting better; it is an operator making one convenience carve-out for a local script.

Keep watching the bare address, not just the hostnames. Ninety-eight of these requests carried no meaningful hostname. Any monitoring keyed on Host is blind to the way this population actually works, and this estate's own host-taxonomy view classifies those as direct_ip, a category carrying 5,832 requests from 1,489 addresses that is worth reading rather than skipping.

Do not read raw status codes here. Twelve of the most consequential requests in this letter — the two full probe sets against the MCP and ComfyUI hosts — are logged as 200 and were refusals. Letter J made this argument about false positives; this is the case where reading raw would have produced a false alarm instead, and a wasted incident.

Method and limits

Single source: the Traefik edge access log, corpus 2026-06-03 → 2026-08-12. The population is this estate's own api_enum classification — 74 addresses, 385 requests, first seen 2026-06-05, last 2026-08-09 — cross-checked against the raw path vocabulary rather than trusted on the label alone, since Letter I established these labels are not always right.

The model inventory (49 models, 507.4 GB, largest deepseek-coder-v2:236b) was read from the local Ollama instance at the time of writing, over localhost. It is stated to establish what was at stake, not as anything an external party could see — the entire point of the letter is that no external party ever saw it.

The estate's public addresses are described rather than printed. They are trivially discoverable through DNS and this is not a secret; printing them in a published dossier simply advertises a target, and the analysis loses nothing by omitting the digits.

Two limits cut against the central claim and should be weighed against it. First, absence of a 200 in the edge log is not proof nothing was ever exposed — it is proof nothing was exposed through this reverse proxy. An inference port opened directly to the internet, bypassing Traefik, would not appear in this corpus at all. I have no evidence that happened and no way to exclude it from this data. Second, the api_enum label is a floor, not a census. An address that probed one model path among many other requests may carry a different, more severe label and is therefore not counted here; the 74 are those whose behaviour was dominated by this hunt.

Attribution stops at the autonomous system. Alibaba Cloud, Cloudflare, DigitalOcean and Liquid Web are infrastructure providers whose customers are the actors here; naming the ASN is not naming the operator, and no operator is identified. Nothing in this letter was produced by contacting, probing, or fetching from any address described.

Confidence: HIGH that no model-enumeration endpoint ever returned a genuine 200 — a direct count over the whole corpus, with the twenty-three real successes individually identified as ordinary web content. Confidence: HIGH that this population hunts services rather than sites, from three independent signals: bare-address targeting, gRPC reflection exclusively against bare addresses, and named CLI tooling. Confidence: MEDIUM on the LLMjacking motive, which is the established economics of this scan class but is not evidenced in traffic that never got past a refusal. Confidence: LOW on nothing here; where the data is thin the claim has been omitted rather than hedged.

The Census, Letter M. Previous: Letter L — The Watchers. The series counts what arrives at one small estate's edge and what the counting gets wrong.