Lava finds 32 Nvidia B300 GPUs on China-linked networks through open monitoring endpoints

What Lava found

Lava, an Israeli security company that studies AI data-center infrastructure, said on 22 October 2026 that it had identified 32 Nvidia B300 GPUs, part of the Blackwell Ultra generation, through monitoring endpoints whose IP addresses are geolocated to China. In a Lava research post, the company says the endpoints returned the exact GPU model names and each card's unique device identifier without asking for any password, which let its researchers count individual chips rather than estimate them.

The B300 is among the most advanced accelerators Nvidia sells, and shipping it to China requires a US export licence that is not being granted for Chinese buyers. The Information first reported the finding on 22 October and, according to Tom's Hardware and other outlets that followed it, tied the addresses to China Telecom, the state-owned carrier. Lava's own post does not name China Telecom. It speaks only of IP addresses geolocated to China, and it repeatedly warns that this is not proof of where the hardware physically sits.

The 32 chips were a small slice of a much larger picture. Across several scans, Lava says it identified 4,724 unique Nvidia GPUs behind publicly reachable monitoring endpoints on China-geolocated addresses, and more than 12,000 GPUs worldwide.

How a monitoring tool gave the chips away

None of this came from a raid, a customs seizure or a leaked contract. It came from Nvidia's own Data Center GPU Manager Exporter, usually shortened to DCGM Exporter, a small open-source service that operators run on GPU servers so monitoring systems such as Prometheus can collect health and performance data. It reads telemetry straight from each GPU, including temperature, utilisation, memory use, power draw and error events, and publishes it over plain HTTP, typically on port 9400.

That design is meant for internal networks. When the port is left open to the internet, anyone can read the same page. In its earlier DCGM Exporter research, Lava explains that a single response names the exact model, such as an H100 80GB, and carries a unique ID for every card. Because those IDs stay the same even when a server's hostname or address changes, an outsider can follow the same physical GPU across repeated snapshots. Where Kubernetes labels are present, pod and project names can also leak, hinting at what the hardware is running.

Lava says it began with a simple search on Shodan, the internet-device search engine, after enabling the exporter on one of its own clusters. Across four scans between March and May 2026, it found roughly 2,100 hosts serving these metrics. Every one answered over unencrypted HTTP and none required authentication.

What else showed up on China-geolocated addresses

Beyond the B300s, Lava counted 374 GPUs across four Blackwell models on China-geolocated endpoints: the 32 B300 SXM6 modules, 78 RTX PRO 6000 Blackwell Server Edition cards, 112 RTX PRO 5000 72GB Blackwell cards and 152 GeForce RTX 5090s. About 86% of those 374 appeared in eight-GPU configurations, the shape of compute servers rather than desktop workstations.

The inventory also included 1,156 GeForce RTX 4090 cards, a consumer graphics card that has been subject to US export restrictions since 2023, spread across 117 monitoring endpoints, 74 of which reported exactly eight GPUs each. A further 160 RTX 4090D cards, the cut-down version Nvidia built for the Chinese market, all appeared in eight-GPU servers too. Lava reads that pattern as gaming hardware being pressed into AI compute work.

Lava is careful about the other Blackwell models. It notes that the RTX PRO 6000 Server Edition and the standard RTX 5090 differ from the China-specific RTX PRO 6000D and RTX 5090D, and that the RTX PRO 5000 needs its own assessment based on exact specifications. Seeing those cards on China-geolocated addresses does not, by itself, establish an export violation, the company says.

Why the B300 matters for export controls

The B300 is the sharpest part of the finding because it sits at the top of Nvidia's product line. According to Tom's Hardware, it offers 50% more memory and FP4 compute than the B200 before it, and it can only be sold to approved buyers who commit not to pass it to sanctioned parties. The finding lands in a week when Washington is tightening other levers on China's AI industry, including a Treasury proposal to ban US investment in superintelligence work in China, while Beijing has moved the other way with proposed export controls on 23 AI technologies.

Smuggling of top-end Nvidia parts is not hypothetical. Tom's Hardware recalls reports in 2025 that Chinese buyers brought in about $1 billion of Nvidia AI chips in three months, and that in August 2026 nine people were indicted in Taiwan over the illegal export of B300 servers to China, a scheme that used a whitelisted Taiwanese server trader, Flying Tiger Tech. Supermicro confirmed days earlier that it had fired several employees after an internal investigation. What makes Lava's data different is that it does not rely on shipping records or informants. The hardware reported itself.

What the data does not prove

Lava itself narrows the conclusion. IP geolocation is not definitive, it says: a proxy, a VPN or a network tunnel could relay traffic through an address in China while the servers sit somewhere else. A monitoring endpoint can also aggregate data from more than one machine. The company says the discovery "raises questions about the location and supply chain of the reported hardware" but "does not establish that any export-control violation occurred".

There are also things nobody has said publicly. Lava has not named the organisation operating the B300s, and Tom's Hardware writes that it is unknown how the chips reached the network or where within it they are located. The data is a set of snapshots, not continuous tracking, so it cannot show when the hardware arrived or whether it is still there. Readers should treat the China Telecom link as The Information's reporting rather than as something Lava's published data shows.

Nvidia's response

Nvidia did not dispute the numbers but played down their significance. "Governments, researchers, and media have all found insignificant diversion of controlled US products, less than one half of one percent in recent court cases — a drop in the bucket compared to the ocean of domestic compute China already has," a spokesperson told Tom's Hardware. "With tens of millions of GPUs in service in approved countries, this report again demonstrates that smuggling is a nonfactor, blocked by governments on both sides of the globe."

In scale terms Nvidia has a point: 32 B300s are a rounding error next to the fleets US hyperscalers are building. The policy question is different, though. Export rules for the most advanced chips are meant to hold at zero, and Nvidia has said it is working on a tool that would let its chips report their location. Tom's Hardware notes that the tool has not yet been released. Until it is, outside scans like Lava's are one of the few public ways to see where controlled hardware is turning up.

The bigger picture: 12,000 GPUs anyone could see

Read beyond the export angle, Lava's dataset is an unusual census of AI hardware. It says the exposed exporters covered just over 2,000 hosts tied to nearly 300 organisations and more than 12,000 GPUs, which it values at roughly $100 million. About half were data-center accelerators such as H100s and H200s, including 312 B200s; the other half were consumer and workstation cards, mostly RTX 4090s and 5090s.

By operator type, consumer GPU and mining farms made up 35% of the exposed GPUs, GPU rental clouds known as neoclouds 25%, general hosting and colocation 19%, telecoms and national internet providers 10%, hyperscalers 6% and universities 5%. The United States accounted for 5,274 GPUs, or 44%, followed by Romania with 2,054 (17%) and China with 1,967 (16%) in the original global sample. The most surprising number, Lava says, was utilisation: in every one of its four scans roughly 60% of the GPUs reported zero use at the moment they were observed, a snapshot it cautions should not be read as an industry-wide measure.

Exposed endpoints were found on customer infrastructure associated with Voltage Park, Lambda, Northern Data and DigitalOcean, among others. The largest group was linked to Voltage Park, with 672 public node_exporter hosts and 71 DCGM Exporter hosts; Voltage Park told Lava most were customer-deployed and contacted the affected customers. It is the same shared-responsibility gap that Nvidia's confidential bare-metal offering is pitched at: the rented GPU is only as private as the software the tenant puts around it.

The DCGM Exporter flaw

The same research produced a real vulnerability. About a quarter of the exposed DCGM hosts were also serving Go's /debug/pprof profiling pages, and Lava found it could reproduce that with Nvidia's official container. Flooding those endpoints with concurrent unauthenticated requests could drive the exporter out of memory, crash GPU monitoring and slow training or inference jobs on the same host. Nvidia assigned the flaw CVE-2026-47483, rated 8.2 out of 10, and fixed it in DCGM Exporter 4.8.2 with a security bulletin in July 2026. Lava says it tested the attack only in a controlled environment.

Lava also found 12,096 public Prometheus Node Exporter hosts leaking details of Nvidia Mellanox InfiniBand and RoCE network adapters, firmware versions and operating-system builds, enough in one example to identify a Dell PowerEdge XE9680 server and its 400 Gb/s link.

What GPU operators should do

Lava's advice is short. DCGM Exporter, Node Exporter and Prometheus should not be reachable from the public internet. Bind exporters to a loopback or private interface, allow only the monitoring system through firewall rules or security groups, and protect Prometheus query pages the same way. Upgrade DCGM Exporter to 4.8.2 or later and leave the --enable-pprof flag off unless profiling is needed. Exposed AI infrastructure is being actively hunted, as the Symantec honeypot that caught an agent hijacking open model servers showed this week.

What happens next

The finding will add to pressure in Washington for chip-location checks and tighter enforcement on approved resellers, and it hands export-control advocates a new kind of evidence that does not depend on court cases. It is also likely to push operators to close their monitoring ports, which would make the next census harder to run. For now, the record shows 32 of Nvidia's most tightly controlled chips announcing themselves on China-geolocated addresses, with the question of who owns them and where they sit still unanswered.