Traffic on seventeen relays wired straight into Anthropic's API skews 58 to 1 toward uploads

A transfer station is a reseller. It holds pooled accounts, issues its own keys to paying customers, and fronts many of them to the model provider as a single caller ^[2]. The provider sees only the relay. Team Cymru says that hides who the users are and where they are, and makes region bans, usage tracking and abuse detection harder to run ^[3]. Sub2api's current release ships user management, per-user billing, a layer that converts consumer subscriptions into API access, and a prompt audit ^[9]. It and its predecessor, Claude Relay Service, are published on GitHub by a developer using the name Wei-Shaw ^[8].

"What we have uncovered is an entire ecosystem designed explicitly to break the frontier model providers' T&Cs, enabling fraud and illicit activity," said Scott Fisher, Senior Principal Engineer at Team Cymru ^[4][5]. Sub2api ran on 9,456 of the first 10,867 relays confirmed, about 87 percent of them ^[14][1]. The project has been forked more than 8,000 times, and its Telegram channel has close to 7,000 subscribers ^[10]. The account sellers get their credentials by exploiting promotional offers and possibly through credential or token theft, according to Team Cymru ^[12].

Two upload ratios came out of the cluster hosted at US VPS providers. Across the cluster as a whole, uploads ran about two to one against downloads ^[17][2]. On the seventeen relays that passed traffic straight to Anthropic, the ratio was 58 to 1 ^[18]. That volume could be consistent with automated, large-scale querying, the researchers say ^[19]. The cluster was also dense, at about 13 client addresses for every one of its 304 relays ^[16][4].

"Rather than independently creating the research, data, and compute required to build a frontier model, an actor can query a stronger 'teacher' model at scale, collect its outputs, and use them to improve a cheaper 'student' model," Fisher said ^[7]. CISA, the NSA and the FBI warned in a joint advisory earlier this month that China-based AI firms are running large-scale knowledge distillation campaigns to pull capabilities out of leading US models ^[6]. Team Cymru could not inspect the prompts or the model responses, so it could not confirm whether the traffic it measured was distillation or another form of abuse ^[20].

Enforcement now starts with the IP list Team Cymru gave the affected providers, and the firm says it will keep looking for new relays ^[21]. The hosts in the confirmed set sat on 457 different networks, with no single hosting provider holding more than about 11 percent of them, or roughly 1,195 relays at the largest ^[15][5]. Address blocking also has to keep pace with a set that went from 10,867 confirmed to more than 80,000, about sevenfold, over the course of the work ^[13][3].