The Namespace Sweep: Guessing Where the AI Lives

TI-2026-073C · Series: The Agent Frontier (Part C) · TLP:WHITE · 2026-07-10

Assessment (MEDIUM-HIGH confidence). Before an attacker can hunt an MCP server or exploit an exposed LLM interface, they have to find the AI infrastructure. The reconnaissance that does the finding leaves fingerprints — and ours show it has gone AI-native. Scanners guessed a string of nonexistent AI-service subdomains against our namespace: mcp.*, lsn-ai.*, lsn-plasma-chat.*, lsn-ai-comfyui.*, and a garbled lltrelsn-llm-factory.*. None exist. All of them prove the wordlist behind the sweep now carries AI-service names. This is the map that the MCP hunting of 073A and the exposed-interface exploitation of 073B then act on — the quiet first move, caught in the catch-all logs.

1. The tell in the 404s

A catch-all log is a confession of what someone expected to find. Every request to a hostname that does not exist is a guess, and a guess is a hypothesis about your naming. Across our web-threats telemetry, a specific class of guess keeps appearing — nonexistent AI-service subdomains:

None of these hosts is served. The point is not that they were blocked — it's that they were guessed. A sweep only lands on mcp or llm-factory or comfyui if those tokens are in its wordlist. That is the whole finding: AI-service names are now seed terms in commodity subdomain enumeration.

2. The garbled guess that gives it away

One entry is worth pausing on. Among the guesses was lltrelsn-llm-factory.shuffle-on.com — a corrupted permutation of our real internal service, lsn-llm-factory. The prefix lltrelsn is a mutation of lsn.

A human typing a guess does not produce lltrelsn. A permutation engine mutating known fragments does — the same class of automated mangling that drives DNS brute-forcing at scale, here carrying llm-factory as a seed and generating variants around it. It is a small artifact with a large implication: the AI-service guessing is machine-driven, not incidental. A tool that emits lltrelsn-llm-factory is a tool that will emit llm-factory, ai-factory, mcp-gateway, and a thousand siblings against every target it touches, automatically.

3. This is the same evolution we already documented — one layer down

We have seen this exact update before, in a different layer. TI-2026-059A — The Secret Harvest caught the commodity credential-file wordlist growing AI-aware: the classic .env / .aws sweep had added /.anthropic/config.json and /.cursor/mcp.json. Someone updated the kit for the AI era.

The namespace sweep is that same update expressed at the DNS layer. The wordlist authors who added .anthropic to the file-path list are the same ecosystem adding mcp, ai, and llm-factory to the subdomain list. It is not a new actor — it is the shared, evolving commodity toolkit, updating its map of what is worth guessing for. When two independent layers of the recon kit (paths and hostnames) both grow AI-fluent in the same window, that is not coincidence; it is a re-tooling.

4. Recon has gone AI-native on both sides

There is a second half to the shift, and it runs the other direction. Attackers are not only guessing for AI services — they are using AI to do the guessing.

2026 reconnaissance practice now folds LLMs directly into the enumeration pipeline. Hadrian reports that adding an LLM-generated wordlist increases discovered subdomains by as much as 10%; AI agents generate 1,000–15,000-entry subdomain lists by correlating detected technologies and recurring naming conventions. Standard recon guides describe ML pattern-recognition and cloud-scale automation as table stakes.

So the reconnaissance front is a two-way AI convergence: AI infrastructure as the target of the wordlist, and AI as the author of the wordlist. Both halves specialise in exactly the predictable naming that homelabs and enterprises use for AI services — ai-, llm-, mcp-, agent-, -gpt. Predictable naming was always a mild liability; against a model trained to predict names, it is a sharper one.

5. Why guessing for AI is rational

An attacker spends effort where the expected payoff justifies it, and AI infrastructure is an unusually good bet:

• The target class is enormous and soft. 175,000 publicly exposed Ollama servers (SentinelLABS + Censys); roughly 40% of MCP servers unauthenticated; exposed LLM interfaces discovered within days (073B).
• The payoff per hit is exceptional. One exposed AI endpoint can yield agent-level access to every tool and datastore it is wired to — or stolen inference compute resold on the gray market (the Compute Hunters economy).
• The cost is trivial. A handful of DNS/vhost guesses to locate mcp or ai or llm-factory is the cheapest prospecting there is.

Cheap prospecting against a rich, soft seam is not a fringe behaviour — it is a rational recon phase, and it will become a standard one.

6. Read between the lines: low volume is the nature of recon

Each of these guesses is a whisper — one to eleven requests per nonexistent host, not a flood. It would be easy to dismiss on volume. That would be a mistake, and an instructive one.

Reconnaissance is supposed to be quiet. The entire MCP-hunt event in 073A was four requests. The threat is measured by what the recon enables — locating the seam that a later stage exploits — not by its packet count. Any detection built on volume thresholds will let quiet enumeration slip under, every time. The signal here is the pattern (AI-service-name guesses, POST /mcp, mcp.* enumeration), not the count. That is why this belongs in the log analysis a defender actually performs, not in the noise they filter.

7. The series, seen whole

Three parts of The Agent Frontier now describe one chain, viewed at three stages:

1. 073C (this) — the map. Guess the AI host by name. mcp., lsn-ai., llm-factory. Cheap, quiet, AI-fluent.
2. 073A — the probe. Once the host is located, confirm the service. POST /mcp with a bespoke tool; a single request that dumps a tool manifest if the server answers.
3. 073B — the raid. When an interface is exposed, 140 IPs arrive: credential sweeps, webshell hunts, login recon against an open LLM.

The map precedes the raid. Catching the map is the earliest warning a defender gets.

8. Detection & defence

1. Log and alert on catch-all AI-name guesses. A 404 for mcp.*, ai.*, llm.*, agent.*, ollama.*, vllm.* on hostnames you don't serve is your notice that your AI attack surface is being mapped. Surface it; don't filter it.
2. Don't rely on obscure hostnames. If you named it lsn-ai or mcp or llm-factory, it is already in a wordlist — and increasingly in an LLM's predicted-name distribution. Authenticate the host; don't hide it.
3. Key detection on pattern, not volume. Quiet enumeration will always be low-count. Match the AI-service-name signature and the POST /mcp fingerprint directly.
4. Treat the recon stage as the tripwire. It is the cheapest, earliest, most reversible point to intervene — before the probe (073A) and long before the raid (073B).

9. Sources

• Web-threats host + ASN telemetry — guessed AI-service subdomains (mcp.*, lsn-ai.*, lsn-plasma-chat.*, lsn-ai-comfyui.*, lltrelsn-llm-factory.*) and the AS16509 vhost-sweep cluster. LSN web-threats platform, 2026-06 → 07.
• Hadrian — Can LLMs improve subdomain enumeration? (LLM-generated wordlists, +10% discovery, 1k–15k-entry agent lists).
• TI-2026-059A — The Secret Harvest (the .env wordlist adding /.anthropic/config.json, /.cursor/mcp.json).
• The Hacker News / SentinelLABS + Censys — 175,000 exposed Ollama servers.
• TI-2026-073A (The MCP Hunters), TI-2026-073B (The Control Plane Lie) — the downstream probe and raid.

Confidence: MEDIUM-HIGH. The AI-service guesses and the permutation artifact are directly observed (HIGH); their interpretation as an AI-aware wordlist evolution is corroborated by the parallel .env evolution (059A) and external recon research (HIGH context). The "who" behind the wordlist is unattributed by nature — it is a property of a shared commodity kit (MEDIUM). Volume is intentionally low; the finding is the pattern, not the count. Fact is tagged [DOCUMENTED]; hypothesis [INFERRED]. TLP:WHITE — the guessed hosts do not exist; no exposure is disclosed.