LLMjacking VAPT Framework Requests to Exposed Ollama API on Port 11434

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.