Relaying to the Frontier

How self-hosted LLM gateways enable Frontier-Model abuse, from region access to distillation 

Executive Summary

Team Cymru has uncovered 10,000+ hidden gateway servers masking malicious activity originating in China that bypassed AI providers' region bans and potentially siphoned proprietary model outputs. This discovery now equips our customers and partners to detect and stop the abuse of frontier AI models, preventing exorbitant recovery costs, and compliance and IP exposure.

Threat

As the frontier AI models (bleeding-edge LLMs) become more capable, the incentives to misuse them grow as well. Abuse can range from bypassing safeguards or geographic restrictions to credential sharing, resale, and proxy services that obscure the identity and location of the underlying user. Frontier-model providers rely on account attribution, usage metering, and behavioral controls to detect and limit this activity. Relay infrastructure, known as “transfer stations”, weakens those controls, acting as a proxy, by separating the apparent requestor from the party actually consuming the service. What we have uncovered is an entire ecosystem designed explicitly to break the frontier model providers’ T&Cs, enabling fraud and illicit activity.

One of the most consequential forms of abuse is model distillation. Rather than independently creating the research, data, and compute required to build a frontier model, an actor can query a stronger “teacher” model at scale, collect its outputs, and use them to improve a cheaper “student” model. This allows portions of the teacher model’s capabilities to be transferred at a substantially lower cost than developing them independently, which is why major frontier-model providers prohibit using their outputs to train competing models.

Software Stack

Claude Relay Service (CRS 1.x) and its successor sub2api (CRS v2.0), are published on GitHub by author Wei-Shaw in Simplified Mandarin and are toolkits that have been widely adopted as proxies to access the frontier models. The latest version (sub2api) includes user management, per-user billing, subscription-to-API conversion layer, and a prompt-audit subsystem.

While sub2api has more capabilities, both enable an actor to turn one set of AI accounts (subscription or API) into a shared gateway. The transfer station holds a pool of LLM credentials to be used upstream, API keys, or logged-in consumer subscription sessions and re-exposes them behind keys of its own that the users of the service use to authenticate. Users authenticate to the transfer station; the transfer station authenticates to the model provider. The provider sees credentials and IP addresses of the transfer station and never sees the actual source IP of the user. The sub2api codebase has been forked over eight thousand times and the Telegram channel for the project has almost seven thousand subscribers, showing the suite is mature and has high adoption.

Sponsors

The sub2api GitHub page lists twenty-six commercial sponsors. Sponsoring a tool helps ensure the developers add specific features requested by the sponsor and the long-term support of the project. Looking at each sponsor’s product and service offering gives us an indication of the primary use-cases for CRS, which is an eco-system built entirely around obfuscation and AI abuse:

• API relay resellers (fifteen sponsors). Gateways selling access to Claude, OpenAI/Codex and Gemini; several marketed to so-called "heavy AI developers." It is likely that these sponsoring organizations require sub2api relay systems as part of their service offering, which likely includes distillation attacks.
• Residential proxy vendors (seven sponsors). Residential proxies are not de facto malicious, but they are very often used for activities ranging from website scraping to network exploitation, as they bypass any geographically-blocked content and are difficult for website owners to block.
• AI account providers (two sponsors).These entities offer frontier-model provider accounts, which are essential for transfer station operations. These entities obtain credentials to the frontier models through illicit means, such as exploiting promotional offers and possible credential/token theft.
• Relay-optimized CDN (one sponsor). Self-described as "purpose-built for large-scale AI API traffic, deeply optimized for relay services."
• Media-generation API (one sponsor). Extending the resale pattern to image and video.

Scale

By analyzing our scanning data over an eight-day window, we identified almost eleven thousand confirmed transfer stations that were running either version. CRS 1.x is deprecated and users are encouraged to migrate to sub2api. Over time we expect the CRS 1.x numbers to drop and sub2api to increase.  

When looking at where the transfer stations are hosted, the population spreads across every type of hosting provider, from the hyperscalers to small VPS providers. No single hosting provider accounts for more than ~11% of transfer stations. This dispersion almost certainly represents multiple distinct operators/organizations using CRS across a diverse background, deploying the software to their preferred hosting providers.

Example: sub2api Cluster

When we analyzed telemetry collected from a transfer station cluster hosted on a few VPS providers in the U.S., we clearly identified Chinese IP addresses initiating connections to the transfer station cluster en masse, which subsequently connected to multiple frontier models. In its entirety, over four thousand Chinese and Hong Kong addresses connected to 304 transfer stations. Over just eight days in late August, the Chinese IP addresses transferred approximately 14 TB up to the transfer station cluster and received over 7 TB down from the transfer station cluster.

To improve the signal/noise ratio and better make sense of the behavior we were observing, we removed IPs with small amounts of traffic (sent less than 1GB/week) from our analysis set. What remained is roughly 244 source IP addresses in China and Hong Kong, reaching 173 of the transfer stations, which in turn reached out to 262 LLM/AI endpoints (frontier models, non-frontier models, training datasets), which looks like: client → transfer stations → AI-endpoints.

On the client side, the largest single concentration was one /24 netblock registered to China Unicom's Shanghai network. Thirteen addresses from that netblock sent approximately 9 TB to one single transfer station over the 8-day window, and each communicated with only that one transfer station.  The concentration and the uniform volume of traffic on a per-relay basis is more consistent with a coordinated deployment than with independent users.

We then moved to analyzing the endpoints the transfer station accessed, and one distinct identifier forced us to divide the AI endpoints into two clusters: Chinese AI companies and Western Frontier LLM providers, although they were accessed by the same transfer station hosts.

Endpoint Cluster 1 · Chinese

Endpoint Cluster 1, the smaller of the two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese client traffic to these Chinese AI providers through a pooled transfer station can be used for aggregation and resale, and is not region circumvention.  

Endpoint Cluster 2 · Western

Endpoint Cluster 2 is significantly larger and comprises multiple U.S.-based frontier models (OpenAI, Anthropic, xAI, and Google endpoints). Traffic to this cluster was very upload-heavy, with a large amount of traffic directed to api.anthropic.com (examined below); the same transfer stations also carried traffic to OpenAI, xAI, and Gemini.

We observed that a large amount of traffic, approximately several terabytes, went to two Cloudflare edges that host OpenAI names along with tens of thousands of unrelated domains. While the volume is large, we cannot conclusively state all the traffic went to an AI model or to other sites Cloudflare serves as a front-end.

A subset of Cluster 2 – Anthropic

Taking a closer look at Endpoint Cluster 2, we identified traffic going directly to an IP assigned to Anthropic’s ASN (AS399358) and has the domain name api.anthropic.com.

 During the eight days, six of the seventeen transfer stations reached the Anthropic endpoint consistently. For every byte these transfer stations downloaded from Anthropic, they uploaded roughly 58 bytes to Anthropic. We found this extremely interesting. While we expected a bias on either upload or download paths, we didn’t expect to see such a dramatic upload bias. Because of the nature of the data we are using for this analysis, we cannot see the actual prompts to gauge if this activity is a form of distillation or other type of abuse. We have reached out to Anthropic for clarification on the usage bias.

‍

Timing and Volume

Aggregated by hour and shifted to China Standard Time (UTC+8), the traffic follows a working-day timeline. The daily-total chart above uses UTC days, while the graphics below use China Standard Time. Volume rises through the CST morning, dips for lunch hour then bounces back, and eventually tails off by midnight. It is interesting to note that the traffic pattern does not follow a typical 6-day work week, which is part of the 996 schedule commonly found in China (9am-9pm, 6 days a week).

Token Cost

If the 81GB uploaded to api.anthropic.com is text-based context, it converts to a very large input token count. At roughly 3.5-5 bytes per token (English through denser or CJK text, after TLS/HTTP/JSON overhead), the upstream carries an estimated 16-23 billion input tokens over the eight days, with 140–200 million output tokens returned. This is just seventeen transfer stations of a 10,867-host population!

Priced as metered API input, or what a paying customer would be charged, that volume ranges across Claude models from Haiku to Fable 5:

API vs Subscription

These figures are the metered-API value of the traffic if the bytes are text and billed per token. Considering CRS is intended to use subscriptions such as Max 20x, the operator's marginal cost above the subscription fee is almost negligible compared to standard API costs (Anthropic has separately stated that similar reseller networks rotate stolen API keys and session tokens). Considering the drive to use the frontier models focuses on the flagship models (Opus/Fable/Mythos) vs Chinese-owned LLMs, the token cost is likely to be on the high side, roughly $160k-240k.

There is also the factor of capacity. With over 10,000 nodes in the U.S., while not confirmed, we can assume many other relay stations are also using the LLMs at a similar rate. As a result, token consumption can have a definite impact on resource availability for abiding users of the T&C’s.

Terms

Each provider's Terms and Conditions plainly state that the primary two use-cases of CRS are not allowed: routing a region-excluded client to a model, and pooling many users behind shared credentials.

For Endpoint Cluster 2, clients are in regions that all three of the verified Western providers exclude, meaning obfuscation services for China-based users is a direct violation of the frontier provider’s policies. For Endpoint Cluster 1, the region objection disappears, as nothing is stated in their terms. What remains is an account-sharing and resale question against domestic Chinese terms we did not obtain.

One Chinese client of the transfer station cluster we analyzed did more than reach AI companies. This host on CHINANET in Beijing sent over 19 GB to a single sub2api node, accounting for 70% of the Chinese traffic that node received. The same host separately reached a large repository of self-described medical imaging data hosted in the U.S. directly, without the transfer station used as a proxy. The repository purports to require authenticated access, and the retrieval ran as sustained full-size packets across two sessions on consecutive days. This part of our analysis is ongoing, and we will provide updates as we find them.

Wrap Up

A transfer station breaks the assumption every frontier-model control depends on: that the account making a request belongs to the party consuming the answer. Account attribution, usage metering, rate limits, abuse detection, regional availability, and the terms that govern all of them are enforced against whoever holds the credentials. The CRS platform circumvents this by masking the true user’s IP address, which allows for abuse on a massive scale.

While over 10,000 IPs are confirmed, analysis on just a few hundred have validated the concerns of western AI companies and governments: Chinese users and organizations are, at minimum, violating the access blocks to the service, and can also easily steal output to clone their own versions.

We have reached out to the relevant AI vendors and shared the IPs we have discovered, and will be proactively hunting for new nodes as they come online to prevent this abuse. 

IOCs

 Tagging

The Team Cymru S2 Threat Detections team has recently completed research on relay services for LLMs that has resulted in new tags being created. The tags are currently available in Command, Recon, Scout, Radar, and the Total Insights Feed. The following is a list of various gateway/relays for LLM API keys and their active volume as of 2026-09-21: