China-linked network activity

Credential-pooling relays are reselling frontier-model access to users the providers never see

Team Cymru counted more than 10,000 self-hosted LLM gateways fronting traffic out of China. They pool accounts behind keys of their own, so the model provider logs the relay's address and never the user's.