PaperlayerView exact revision on arXiv

Source-linked AI summary

Ollama in the Wild: A Longitudinal Measurement of Exposed Ollama LLM Endpoints at Internet Scale

Zuyao Xu, Xiang Li, Yuqi Qiu, Lu Sun

arXiv:2609.07115v1cs.NI

TL;DR

Prior research left the year-scale persistence, software evolution, and infrastructure concentration of exposed Ollama endpoints largely unmeasured. The authors probe public IPv4 port 11434 endpoints daily for a year and enrich observations for longitudinal analysis. They find rapid IP churn alongside recurring software and infrastructure patterns, with low in-place upgrade rates across selected CVEs.

  • Problem

    Existing analyses of exposed Ollama were predominantly snapshots, leaving endpoint persistence, software evolution, operator geography, and mitigation targeting insufficiently characterized.

    Source: §1 · p. 1

  • Method

    The study combines daily active probing of public IPv4 port 11434 endpoints with GeoIP/ASN, PTR, and TLS enrichment and survival analysis.

    Source: §3.1 · p. 3, §3.3 · p. 4

  • Results

    26.4% of cumulative IPs appeared for one day, while recurring software and infrastructure patterns remained visible and in-place upgrades across five selected CVEs were 0.43%–2.90%.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors conclude that exposed self-hosted LLM services form a persistent cloud-hosted pattern for which upstream-safe defaults and provider-side alerts are likely to be more effective than host-by-host remediation.

    Source: §9 · p. 12

    The single-vantage study covers public IPv4 on Ollama’s default port, excluding deployments behind NATs, firewalls, or authenticated reverse proxies and those using IPv6 or non-default ports.

    Source: §8.4 · p. 12

Abstract

from arXiv · show

Self-hosted large language model (LLM) serving is emerging as a distinct category of Internet service, but we still know little about how these deployments appear and change on the public Internet. We present a 365-day longitudinal measurement of exposed Ollama endpoints (port 11434) from February 2025 to February 2026, combining daily active probing with GeoIP/ASN enrichment, PTR and port-443 host observations, and survival analysis. Across 362 observation days and approximately 4.8 million IP$\times$day observations, 26.4% of the 152,137 cumulative IPs appear for a single day; across five selected CVEs, only 0.43-2.90% of below-fix IPs upgraded in place; the top five countries/regions account for over 70% of weighted observations; and cloud and hosting providers dominate the top ASNs. These results characterize exposed Ollama as a structural exposure surface: persistent, growing, and heavily concentrated. At the same time, old versions, common model choices, cloud and hosting ASNs, PTR categories, and TLS certificate patterns remain visible across the year, indicating recurring insecure deployment practices in cloud infrastructure and the potential reach of provider-level mitigation.

1 Introduction

Prior counts and vulnerability disclosures did not establish how exposed Ollama endpoints persist, change, or concentrate across operators. This study measures those dynamics over a year and finds recurring exposure alongside substantial churn.

1 Introduction

  • Prior counts and vulnerability reports left endpoint lifetimes, software evolution, operator geography, and the prospects for provider-targeted mitigation largely unanswered.The authors describe longitudinal characterization of exposed Ollama as absent from the measurement literature.Source: §1 · p. 1
  • The study conducts daily IPv4-wide probing of port 11434 for 365 days, retaining 362 observation days and approximately 4.8 million IP×day observations after collection failures.Responsive IPs were enriched with GeoIP/ASN, PTR, and port-443 TLS observations, and endpoint lifetimes were analyzed with survival methods.Source: §1 · p. 1
  • 26.4% of cumulative IPs appeared for one day, while 10.3% were observed on at least 90 days; in-place upgrades across five selected CVEs were only 0.43%–2.90%.The population grew by 53.3% over the measurement window, and the top five countries/regions accounted for about 70% of weighted observations.Source: §1 · p. 2
  • The paper contributes year-scale de-identified data and analysis tools, longitudinal exposure baselines, a full-population PTR census, and a remediation strategy involving provider-level interventions.The proposed paths include tenant notification and upstream default changes.Source: §1 · p. 2

2 Background and Related Work

Ollama’s accessible, unauthenticated API and common deployment paths create a measurable exposure surface. Prior work provides discovery tools and partial views, while this study addresses the lack of year-scale, unified measurement of exposed LLM-serving endpoints.

2.1 Ollama and Self-Hosted LLM Serving

  • Ollama’s API runs on port 11434 without built-in authentication, and Docker recipes and tutorials can bind it to a public interface.The API also supports model-management operations, and disclosed vulnerabilities include remote code execution, file disclosure, denial-of-service, and unauthorized access.Source: §2.1 · p. 2

2.2 Exposed-Service Measurement

  • Prior exposed-service studies use Internet-wide discovery tools and characterize services such as databases and cloud storage, but often observe them only in snapshots or short windows.Longitudinal work shows that persistence and churn can reveal structural properties hidden by snapshot methods.Source: §2.2 · pp. 2–3

2.3 AI Serving Infrastructure

  • Industry reports on exposed AI infrastructure provide situational awareness but do not quantify temporal dynamics, software changes, concentration, and operational profiles together.The paper identifies snapshot bias, indirect sourcing, and fragmented scope as limitations of those reports.Source: §2.3 · p. 3
  • Measurements of Ollama should not be generalized directly to vLLM, LocalAI, or Text Generation Inference because their binding, authentication, and deployment channels differ.Source: §2.3 · p. 3
  • The study is presented as the first year-scale longitudinal measurement of exposed LLM serving, combining 362 observed days, direct probing, four analytical dimensions, and survival analysis.The dimensions are temporal dynamics, software ecosystem, geographic and infrastructure concentration, and operational characterization.Source: §2.3 · p. 3

3 Measurement Design

The measurement defines exposed endpoints by their public IPv4 address, default Ollama port, and expected API response, then combines daily observations with per-IP enrichment and longitudinal metrics. Data-quality controls distinguish missing or low-coverage days from the retained observation set.

3.1 Observation Setup

  • The study observes public IPv4 endpoints on TCP/11434 daily from one vantage point, recording model inventories and version strings across 362 observed days.Three scan days are missing, and 11 low-coverage days remain in the dataset but are excluded from several rate-based metrics; the corpus contains approximately 4.8 million IP×day observations.Source: §3.1 · pp. 3–4

3.2 Measurement Pipeline

  • The pipeline combines daily XMap probing, one-time GeoIP/ASN, PTR, and TLS enrichment for each unique IP, and longitudinal aggregation of the enriched observations.GeoIP/ASN attribution matched 99.84% of unique observed IPs; the resulting metrics include survival, churn, and country/region- and ASN-level concentration.Source: §3.2 · p. 4, Figure 1 · p. 4

3.3 Metrics and Survival Analysis

  • Daily counts describe endpoint and software populations, survival metrics summarize observed lifetimes, and IP-day-weighted shares and HHI quantify geographic and infrastructure concentration.For survival, active days count dates an entity is observed; concentration weights an IP by its number of observed days.Source: §3.3 · p. 4

4 Temporal Dynamics

The section traces exposed Ollama endpoints across a year, showing a rise, decline, and recovery in the active population alongside continuing discovery. Endpoint lifetimes and daily churn reveal substantial turnover beneath aggregate counts.

4.1 Exposure Scale and Trend

  • Active IPs rose 60% from 10,473 to a peak of 16,821, then recovered to 16,059 on the final observation day after an intervening decline.Figure 2(a) tracks the daily alive-IP count.Source: §4.1 · pp. 4–5, Figure 2 · p. 5
  • The 152,137 cumulative IPs produced a cumulative-to-active ratio of 9.47, indicating that historically exposed nodes outnumbered currently active ones by nearly an order of magnitude.Figure 2(a) also plots cumulative IP discovery.Source: §4.1 · p. 5, Figure 2 · p. 5

4.2 IP Survival Analysis

  • 26.4% of cumulative IPs appeared on exactly one day, while 10.3% were observed on at least 90 days and 4.4% on at least 180 days.The median survival was 5 days, and the longest-lived IPs appeared on 358 of 362 days.Source: §4.2 · p. 5, Figure 2 · p. 5

4.3 Daily Churn

  • Excluding the first day and transitions involving missing or low-coverage days, daily churn averaged 775 new and 761 retired IPs, about 5.8% of the mean alive population.This turnover means aggregate stability masks substantial population replacement.Source: §4.3 · p. 5, Figure 2 · p. 5

5 Software Ecosystem Evolution

Across the exposed Ollama population, software diversity increased while model and version identifiers often persisted longer than individual IPs. Version-based patch analysis found few in-place upgrades, with population turnover accounting for much of the observed change.

5.2 Model and Version Turnover

  • Model leadership stabilized on smollm2:135m in July 2025, while version leadership shifted from release-paced turnover to 0.1.33 from October.The early version leaders changed every one to two months through September; 0.1.33 is a pre-Probllama 2024 release.Source: Figure 4 · p. 6, §5.2 · pp. 6–7, Figure 5 · p. 6

5.1 Model and Version Diversity

  • Daily unique model counts rose from 1,797 to 5,643 (+214%), and unique version counts from 112 to 182 (+62.5%); their correlations with alive IPs were 0.29 and 0.23.The version correlation begins when version probing started; both metrics showed limited day-to-day co-movement with exposure scale.Source: §5.1 · p. 6

5.2 Model and Version Turnover

  • Llama led model families (8.65M observations; 46.3%), while smollm2:135m led individual models (1.49M; 8.0%) and version 0.1.33 led versions (288k; 6.5%).The top 10 models accounted for 34.0% of model-day events; model names ending in :latest were retained as reported despite being mutable aliases.Source: §5.2 · p. 6, Table 3 · p. 7

5.3 Model and Version Active Days

  • Median active days rose from IPs (5 days) to model identifiers (18 days) to versions (114 days); several top models appeared on 360 of 362 days.These counts measure how long an identifier remains visible across the population, regardless of which endpoint reports it.Source: Figure 6 · p. 7, §5.3 · p. 7

5.4 CVE Patch Adoption

  • Only 0.43–2.90% of below-cutoff IPs upgraded in place, while 30–65% disappeared and 882–1,796 new IPs arrived below-fix.The transition analysis covers five CVE cutoffs; even long-lived IPs upgraded in place at rates no higher than 2.90%.Source: Figure 7 · p. 8, §5.4 · pp. 8–9
  • Below-cutoff shares fell from 55.32% to 23.65% for < 0.6.8 and from 60.98% to 41.04% for < 0.12.4, but version status does not establish exploitability.The declines occurred over seven months and two months, respectively; the analysis treats a parsed version below the fix as potential CVE status, not proof of exploitability under runtime configuration.Source: §5.4 · pp. 7, 9, Figure 8 · p. 8

6 Geographic and Infrastructure Concentration

Weighted observations show geographic concentration alongside a more dispersed distribution across individual ASNs. Re-aggregating ASNs by provider identifies a small group of cloud and hosting operators associated with a substantial share of observations.

6.1 Country/Region-Level Concentration

  • The top five countries/regions account for 70.1% of weighted observations and the top 10 for 81.1%, across 157 represented countries/regions.China accounts for 29.09%, the United States 21.65%, Germany 9.06%, France 7.43%, and Hong Kong 2.82%; country/region HHI is 0.1500.Source: §6.1 · pp. 9–10

6.2 ASN-Level Concentration

  • The top 10 ASNs account for 42.1% of observations across 4,465 ASNs; the top five are cloud or hosting providers, and ASN-level HHI is 0.0243.AS37963 (Alibaba/Hangzhou) leads with 8.02%; the strongest provider–geography pair is AS37963 × CN, with 384,739 weighted observations.Source: §6.2 · p. 10

6.3 Cloud-Provider Perspective

  • After grouping ASNs by operator, the top 10 providers account for 46.69% of weighted observations and the top five for 33.51%.The provider-level view identifies coordinated deployment-default changes and tenant-facing exposure alerts as potential mitigation pathways.Source: §6.3 · p. 10

7 Operational Characterization

Operational signals show distinct deployment contexts among exposed endpoints, including cloud and hosting infrastructure, varied co-located HTTPS services, and lifetime-linked PTR profiles. Short-lived and persistent IPs differ in their observed infrastructure categories.

7.2 TLS Certificate Characterization

  • Only 14.44% of IPs completed a port-443 TLS handshake; among responders, 9.68% had expired certificates, while Let’s Encrypt issued 49.39%.RSA-SHA256 led signature algorithms at 66.58%; issuer composition also varied by PTR category.Source: Table 6 · p. 11, §7.2 · p. 11, Table 7 · p. 11

7.1 PTR-based Deployment Categorization

  • PTR records were present for 43.22% of cumulative IPs, and 49.61% of PTR-present IPs passed forward verification; cloud and hosting categories covered 24.49% of all IPs.The six PTR categories use cascading rules; hyperscale cloud accounted for 12.97% of all IPs and VPS hosting for 9.89%.Source: §7.1 · p. 11

7.3 Survival and Deployment Type

  • The 1-day IP bucket was dominated by hyperscale-cloud IPs (27.3%) and no-PTR IPs (49.8%), while the ≥181-day bucket had more VPS hosting (20.7%) and custom domains (12.3%).Across lifetime buckets, hyperscale share decreased and VPS-hosting share increased; the pattern is consistent with churn concentrated in particular infrastructure types.Source: §7.3 · p. 11

8 Discussion

The discussion describes exposed Ollama as rapidly turning over at the IP level while retaining recurring software profiles and concentrated hosting. It argues that supply-side mitigation is better suited to this pattern, while limiting conclusions to the study’s observational scope.

8.1 Exposure Pattern

  • 26.4% of IPs appeared on only one day, yet version 0.1.33 remained among the top three monthly versions in the final five months.The 2024 release was the largest single version across the year.Source: §8.1 · p. 12
  • Top 10 providers carried 46.69% of weighted observations, hyperscale cloud and VPS hosting accounted for 56.69% of PTR-classifiable IPs, and at most 2.90% of below-cutoff IPs upgraded in place.The authors attribute aggregate software change mainly to departures and later arrivals, with little observed upgrading among continuing IPs.Source: §8.1 · p. 12

8.2 Remediation Strategy

  • Rapid IP turnover limits operator-by-operator remediation, so the authors propose framework guidance and provider notifications alongside operator controls for public access.Suggested measures include authentication or private-network controls, provider detection and targeted notifications, and binding Ollama to localhost or a private interface.Source: §8.2 · p. 12

8.3 Implications and Outlook

  • Similar exposure risks may arise in vLLM, LocalAI, and Text Generation Inference because they share deployment paths such as container images, quick-start commands, and cloud templates.The authors identify comparison across other AI serving systems as future work and expect deployment defaults and provider-side controls to matter increasingly.Source: §8.3 · p. 12

8.4 Threats to Validity

  • The measurement covers public IPv4 addresses reachable on port 11434, with three missing scan days and 11 observed days excluded from rate-based metrics.GeoIP/ASN, PTR, and port-443 observations were collected once after the measurement window, so they cannot reconstruct changes during the year; the authors restrict claims to the dataset’s observational scope.Source: §8.4 · p. 12

9 Conclusion

The paper concludes that exposed Ollama has rapid IP churn but stable structure across software, geography, providers, and organizational identity. Its study used read-only, metadata-focused probes and released aggregate artifacts while keeping raw per-IP records internal.

9 Conclusion

  • Across 152,137 cumulative IPs and 362 daily observations, exposed Ollama showed rapid IP-level churn alongside stable structure in software versions, model use, geography, providers, and organizational identity.The authors conclude that upstream-safe defaults and provider-side alerts are likely to be more effective than host-by-host remediation within the study’s scope.Source: §9 · p. 12

A Ethics

  • Probes retrieved metadata without inference requests, state changes, private-path enumeration, prompt submission, or model-weight retrieval; released artifacts contain aggregate statistics, not raw per-IP records.The authors state that their measurement followed established ethical guidelines and did not uncover a new software vulnerability.Source: A Ethics · pp. 13–14

B Generative AI Disclosure

The manuscript discloses generative AI assistance in figure scripts, formatting, and language refinement. The appendix also documents the ordered PTR classification rules, including how unmatched PTR records and missing PTR records are handled.

B Generative AI Disclosure

  • Claude Code 2.1.121 assisted with figure-generation scripts, LaTeX formatting, and language refinement; the authors reviewed and edited all generated outputs.The authors state that they bear responsibility for the final manuscript’s scientific accuracy and integrity.Source: B Generative AI Disclosure · p. 14

C PTR Classification Details

  • PTR classification applies cascading rules in order, assigns unmatched PTR-present IPs to Custom domain, and reports missing-PTR IPs as a seventh class.The paper documents the full whitelists and regular expressions for reproducibility.Source: C PTR Classification Details · p. 14

D CVE Coverage and Cutoff Selection

The authors select five measurable CVE cutoffs from 21 cataloged Ollama daemon CVEs, applying explicit criteria to retain cases suitable for longitudinal analysis.

D CVE Coverage and Cutoff Selection

  • CVEs were excluded when duplicates, too-small affected populations, late disclosure, or missing NVD fix versions prevented meaningful remediation analysis.The population threshold was fewer than 5% of version observations.Source: D CVE Coverage and Cutoff Selection · p. 14
  • The five selected cutoffs span RCE, information disclosure, token exposure, and authentication bypass.The selected cases include CVE-2024-37032, CVE-2024-45436, CVE-2024-39719, CVE-2025-51471, and CVE-2025-63389.Source: D CVE Coverage and Cutoff Selection · p. 14
  • Below-cutoff populations for the five selected CVE cutoffs range from 7.4% to 85.9% of version observations.Source: D CVE Coverage and Cutoff Selection · p. 14

E Artifact Availability

The artifact is partial: it releases aggregate and de-identified data and analysis materials, but withholds raw per-IP records, limiting reruns of analyses that require them.

E Artifact Availability

  • The release includes analysis and figure-generation code, aggregate and de-identified data for all 362 observed days, and pre-generated figures.Released summaries include daily alive counts, geographic and ASN distributions, model and version frequencies, survival distributions, PTR/TLS probing, and CVE patch-adoption summaries.Source: E Artifact Availability · p. 14
  • Analyses requiring withheld per-IP records cannot be rerun from the public artifact alone; scripts document the processing logic.The withheld records include daily alive snapshots, GeoIP-to-IP mappings, PTR hostnames, and TLS certificate details, which are excluded to protect host privacy.Source: E Artifact Availability · p. 14
  • Table 8 lists PTR-classification whitelists and regular expressions applied in cascading priority order.Source: Table 8 · p. 15
  • Table 9 catalogs 21 daemon CVEs by fix version and reports CVSS, vulnerability class, below-cutoff population, and selection status.Below-cutoff population is the percentage of version observations below the fix threshold across all 362 observed days; bold rows identify the five selected cutoffs.Source: Table 9 · p. 15, E Artifact Availability · p. 15
Loading 2609.07115v1…