Small Numbers, Real Systems: 384 Reachable vLLM Endpoints

Not every exposure is a large one, and a small count can describe systems that matter. A ZoomEye query for app="vLLM" returned 384 matching assets on 4 October 2026. That is the smallest population in this series, and it is the one most likely to represent deliberate production use.

Why a small population behaves differently

vLLM is a high-throughput inference server, usually operated by teams that have already invested in serving infrastructure. Deployments tend to be planned, so the interesting question is not whether the software is used casually but whether the operational team intended the endpoint to be public.
The NCSC assessment notes that sophisticated use of AI in cyber operations will likely remain restricted to actors with expertise and resources, while commoditisation spreads improved capability more widely. Production inference endpoints are attractive to the first group because they offer capacity and, potentially, the models and prompts in use.

Reading a small figure

384 is small enough that a scoped query can be reviewed rather than sampled. Adding country or org narrows it further, and the resulting list is short enough to compare against a known inventory by hand. That is a different workflow from the one appropriate to a six-figure population, and it is a reminder that the size of a count should determine how it is used.

Hardening inference endpoints

Put authentication in front of the API and authenticate at the gateway rather than inside the server. Restrict who can reach the endpoint by network policy, since inference capacity is the resource being protected. Log requests with enough detail to identify unusual patterns, and review prompt and completion logging against data protection requirements, because inference logs can contain anything users sent. Where a public endpoint is genuinely required, front it with rate limiting so that capacity cannot be consumed by an unauthenticated caller.

Evidence limits

A fingerprint match does not indicate model size, access controls or whether the endpoint accepts unauthenticated requests. It indicates that a service is reachable, which is the first condition an attacker checks.