OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
The paper reports on Ollure, a low/medium-interaction honeypot that mimics the Ollama API to measure how exposed self-hosted LLM infrastructure is discovered and attacked across 84 days, capturing mostly automated scanning plus attempts at model abuse, traversal/SSRF, RCE, cryptomining, resource exhaustion, prompt injection, data extraction, and agent-tool exploitation. What’s interesting is that it gives rare empirical evidence of real-world LLM-infra targeting beyond hypothetical prompt attacks, though its view is limited by emulating Ollama without a live backend model and by the relatively narrow deployment scope and duration.
Abstract
Publicly exposed large language model (LLM) infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and university networks, Ollure operated for 84 days and recorded 290,887 interactions from 2,793 unique source IP addresses. Most of the activity consisted of automated discovery, fingerprinting, and model enumeration. However, we also observed concrete exploitation attempts against both the infrastructure and LLM layers. These included model management abuse, path traversal and SSRF probes, RCE and cryptocurrency mining payloads, resource exhaustion attempts, prompt injection, information extraction, and agent-oriented tool use. Our results provide empirical insight into real-world threats against exposed, self-hosted LLM services.