The supply chain behind cheap Claude and GPT tokens

What happens after a customer pays

The buyer sees an API endpoint and a price. Behind it, the operator manages a pool of accounts and credentials and a scheduler that distributes requests across them.

One of roughly ten open-source packages will run the gateway on a cheap server. The buyer points a client or coding agent at the relay, pays in RMB or stablecoin, and sends the same request they would send to the official API. The gateway selects an account, forwards the request upstream and streams the response back. Relay operators also replay the headers and identifiers of the provider's own client. The gateway software supports another choice: replacing the requested model with a cheaper one while retaining the premium model's name in the response.

The storefront operator does not have to build the account pool. Another seller assembles it with automated browsers, residential proxies, bulk SIMs and purchased identities, then sells the accounts wholesale. Once the relay starts forwarding requests, its operator has access to the prompts and responses crossing the server. The low price, the account supplying it and the traffic it carries are parts of the same transaction.

Our API relays guide covers the gateway itself. The token fraud hub puts relays alongside the other ways platforms lose account capacity and compute.

Accounts by the thousand

An account farm needs every registration to look like a different customer. The work starts with the browser and its connection, then moves through phone and payment checks.

Anti-detect browsers handle the browser identity. These Chromium or Firefox forks alter fingerprints at the engine level, below the JavaScript runtime used by many detection scripts. They change canvas output, WebGL vendor and renderer strings, AudioContext output, installed fonts and WebRTC ICE candidates. Each profile presents as a different consumer machine. The products include Multilogin, GoLogin, AdsPower, Kameleo and the open-source Camoufox.

For headless requests, libraries such as curl_cffi, tls-client, CycleTLS and uTLS imitate a browser on the network. They reproduce a chosen ClientHello, ALPN order and HTTP/2 settings, alongside browser headers. Those fields are exactly where platforms have looked for differences between automated clients and ordinary traffic.

JA3 hashes fields from the TLS ClientHello. JA3N sorts extensions before hashing them, addressing the extension-order changes that made JA3 less stable. JA4 and the JA4+ family divide the fingerprint into fields that include the TLS version and ALPN, with hashes for other components. Akamai's HTTP/2 fingerprint includes SETTINGS order, the connection WINDOW_UPDATE, priority information and pseudo-header order. JA4H describes the HTTP request, including header order and cookie information. JA4T records the TCP SYN window and options.

Each fingerprint observes a different part of the connection. A TLS library can match a Chrome ClientHello while the TCP connection still reflects the machine or proxy that opened it. HTTP version matters too. RFC 9113 requires lowercase field names in HTTP/2, so header casing has a different meaning there than in HTTP/1.1. A defender has to compare the connection as a whole and follow the account's behavior over time.

The farm then needs addresses that look like home connections. Some proxy networks acquire bandwidth through software installed with the user's consent. Others use compromised devices or software whose users did not agree to act as proxy exits. In a 55-day study of 30 proxy services with weak customer checks, Bitsight TRACE observed 53 million unique exit nodes. About 15% of distinct egress IPs, roughly 8.2 million, were simultaneously flagged for active malware infection.

The 911 S5 takedown shows what one operation can assemble. In May 2024, the US Department of Justice described a network of more than 19 million consumer IP addresses. Free VPN applications had quietly enrolled the devices on which they ran. A platform receiving a request from one of those addresses sees a residential connection, not the person controlling it.

One published estimate puts a finished account at $5 to $10. The table weights the cost of checks that do not occur on every sign-up. These are estimates, not measured market prices.

Free sign-up credit can cover much of that cost. A funded account is more valuable still: a carded subscription with a high monthly quota can be divided among relay customers, and relay packages advertise account sharing as a feature. Our free trial abuse guide follows the creation of disposable accounts. The card testing and chargebacks guide covers the stolen cards used to fund others.

A phone number for a penny

Once the browser and connection are ready, the farm meets the phone check. A SIM bank is a 1U rackmount appliance with dozens or hundreds of physical SIM slots, an Ethernet port and an HTTP API. Software requests a one-time code using a SIM in the rack and reads the reply back through the same system.

Operators buy SIMs in bulk from carriers with lax know-your-customer checks, aggregate thousands across multiple boxes and sell the capacity to virtual-number platforms. Those services resell individual codes for less than a cent. They sort numbers by the service a buyer intends to register with, because a number blacklisted by one platform no longer has the same value for that platform. Reported examples include 5sim, HeroSMS and SMS-Man; one estimate puts a 5sim number at roughly $0.008.

A valid SMS code establishes that someone received a message at that number. It does not establish that the account belongs to a distinct person. Banks added biometric checks for that reason. AI platforms now face the same market when they add a phone step.

A face and an ID on demand

When a platform asks for a document, there is a market for that too. In February 2024, 404 Media investigated OnlyFake, a service selling computer-generated driving licences, passports and national IDs for about $15 each. The seller said it used neural networks. The resulting images placed the documents against ordinary backgrounds, and the operator claimed a production capacity of up to 20,000 documents a day. The reporter tested one generated ID against the OKX crypto exchange. It passed the identity check.

The coded lines at the bottom of a passport are its machine-readable zone. They encode identity fields and check digits. ICAO Doc 9303, Part 3 specifies the calculation, including the repeating 7-3-1 weights. Earlier forgeries with incorrect check digits failed validation; generators now calculate the digits when creating the document. A valid check digit confirms that the fields are internally consistent. It does not establish that the document was issued or belongs to the applicant.

The selfie check has a different weakness. An attacker can put a synthetic face into the camera feed itself. Real-time face-swap tools such as DeepFaceLive and Deep-Live-Cam feed a virtual camera. On desktop, OBS Virtual Camera or Linux v4l2loopback presents the result as a camera device. On mobile, an emulator and a hook on the camera API supply substituted frames to the verification app. The camera APIs include Android's Camera2.createCaptureSession() and iOS AVCaptureSession.

The verification app receives frames without seeing where they came from. A real-time swap can follow a head-turn instruction. An injected frame also lacks the physical screen reflections and moiré that a presentation-attack detector looks for in a filmed replay. Presentation-attack detection examines what is presented to a camera; injection-attack detection addresses whether the app received frames from the real sensor path.

iProov's 2025 threat report, based on its operations-centre observations and threat research, recorded a 300% increase in face-swap attacks over 2023 and a 2,665% increase in native virtual-camera attacks. It also counted nearly 24,000 users selling attack technology through crime-as-a-service channels. Those are iProov's figures from its own observations, not a count of the whole market.

By the time an account passes these checks, it can have a working phone number, a coherent document and a live-looking face. A platform still needs evidence beyond the material presented at sign-up.

The relay and the model swap

Once the accounts are ready, a gateway connects them to the storefront. Its architecture resembles an ordinary multi-tenant service: authentication middleware, an account scheduler, health checks, credential rotation, request logs and an admin panel. It accepts requests in the upstream API's format and returns streamed responses in the format the customer expects.

CISPA found that 11 of the 17 shadow APIs it identified used open-source gateways, chiefly one-api and its derivative new-api. Team Cymru examined another lineage, claude-relay-service and its successor sub2api. It counted 10,867 servers running those two packages across 457 networks in eight days of scan data. The company later reported finding more than 80,000 relays, without giving a method for that later figure. The same gateway software also has legitimate single-user and household uses.

Relays using subscription credentials also imitate the provider's own client. A February 2026 capture of Claude Code traffic included User-Agent: claude-cli/2.1.39 (external, cli), x-app: cli, X-Stainless-* client headers, anthropic-version: 2023-06-01 and beta identifiers including oauth-2025-04-20 and interleaved-thinking-2025-05-14. These identifiers describe that client snapshot. A relay can replay them with the subscription credential while presenting a separate API key to its own customer.

The provider sees the relay's upstream credential and connection. The relay sees its customer's request and chooses which upstream account sends it. That division makes the storefront harder to connect to the accounts supplying it. Our API relays guide covers the supply routes and the traces they leave in platform logs.

The gateway controls the model field in both directions. An operator can rewrite the outgoing model field to select a cheaper model, then rewrite the response field so the customer still sees the model they ordered. The gateway can also preserve or fabricate the usage fields presented to the customer. The Chinese term for the practice is 降智, or intellect-dumbing.

CISPA tested 24 endpoints across three shadow APIs. Eleven, or 45.83%, failed its model-fingerprint verification. In one benchmark, the official Gemini-2.5-flash endpoint scored 83.82% on MedQA; endpoints advertised as the same model scored about 37%. The authors distinguish behavioral differences from fingerprint evidence of substitution, and do not extend the result to all 17 providers in their wider sample. Fifteen of those 17 services lacked transparent, verifiable operator identity; four had closed by the time the paper was written, exposing prepaid customers to the loss of their remaining access. Price did not reliably identify the model that answered.

Account rotation also affects the price of context. Prompt caching discounts repeated prefixes such as system prompts and earlier turns. Anthropic's pricing puts a cache read at 0.1 times the base input price for many models, with lower rates for some newer models. When a relay moves a customer to a different account, that account's cache can miss and the shared prefix has to be processed again. The gateway controls the usage fields the customer sees, including cache_creation_input_tokens and cache_read_input_tokens. The relay's response alone does not establish how much upstream caching occurred.

Relays also depend on other relays. A prefix-cache side-channel study sent 1.1 million requests across 636 pairs of reseller endpoints. It found shared cache reach in 37.1% of measured pairs and a containment structure seven layers deep. One upstream pool can therefore support several storefronts whose customers see different brands and endpoints.

The logs are the real product

Every request and response passes through the relay. The gateway can send the upstream response stream to the customer and copy it to a log sink at the same time. The request contains the user's messages, system prompt, tool definitions and tool results. The response contains the model's answer, tool calls and any reasoning content returned to the client.

For a coding agent, those requests and tool results contain file paths, source files and command output when the agent sends them to the model. Later turns carry code the developer kept or modified. A relay that records the sequence obtains the task, the tools used on it and the subsequent work. The developer's acceptance gives a training pipeline a signal about which output was useful. It does not establish that the code is correct.

In its September 2026 report, Anthropic described a case in which Moonshot forwarded customer requests to Claude while presenting the responses as Kimi. Moonshot saved part of the exchanges for model training, according to the report. Anthropic observed almost 300,000 customer requests over ten days through a proxy network of 5,380 fraudulent accounts. The forwarded requests included customer code and live credentials.

Public fine-tuning datasets also contain Claude reasoning, including Crownelius/Opus-4.6-Reasoning-3300x and nohurry/Opus-4.6-Reasoning-3000x-filtered. Another dataset, lordx64/reasoning-distill-claude-opus-4-7-max, documents 8,124 conversations and says it collected them through the official API. A dataset's existence does not establish that its contents came from relay logs.

A joint CISA, NSA and FBI advisory describes industrial-scale distillation campaigns using the transfer-station market. Anthropic's February and September reports connect fraudulent account pools to specific extraction campaigns. The requests and responses passing through a relay are a second asset alongside the access it sells.

The economics behind the discount

A relay's costs depend on its supply. Free trial credits, shared subscriptions, stolen-card payments and leaked keys put the cost of compute somewhere other than the storefront. A model swap reduces the cost of a response again. A retained log corpus has a separate use as training data, although the reports do not give it a public market price.

The published price observations cover different parts of the market. They do not establish one discount for every relay.

A price far below list is a reason to examine the upstream funding. It does not identify that funding on its own. The same storefront can draw on several types of account, and a near-list price does not rule out substitution. CISPA's table includes prices above list as well as deep discounts. Its fingerprint results establish why a customer cannot infer model identity from price alone.

What Anthropic's defenses reveal

In February 2026, Anthropic reported more than 16 million Claude exchanges from campaigns it attributed to DeepSeek, Moonshot and MiniMax. The exchanges passed through approximately 24,000 fraudulent accounts. One proxy network managed more than 20,000 accounts at once, mixing extraction traffic with unrelated customer requests. Anthropic calls these networks hydra clusters.

The campaigns had different targets and volumes. Anthropic attributed more than 150,000 exchanges to DeepSeek, more than 3.4 million to Moonshot and more than 13 million to MiniMax. In the DeepSeek operation, it saw matching request patterns, shared payment methods and synchronised timing across accounts. It used request metadata, correlated IP addresses, infrastructure indicators and, where available, reports from industry partners to attribute activity. When Anthropic released a new model during the MiniMax campaign, the operation redirected nearly half its traffic to the new model within 24 hours.

An individual prompt did not have to look unusual. Anthropic described variations of a prompt arriving tens of thousands of times across hundreds of coordinated accounts, all directed at the same narrow capability. It built classifiers for extraction patterns, including attempts to elicit chain-of-thought, and behavioural fingerprints for coordinated account activity. It also tightened verification for education, security research and startup programs, and shared technical indicators with other labs, cloud providers and authorities.

By its September report, Anthropic had attributed more than 151 million exchanges between May and July to an Alibaba campaign. Its first pool contained nearly 5,000 fraudulent accounts using residential proxies, disposable email addresses and virtual-card payments. After Anthropic banned that pool, the traffic shifted to a second one. Accounts in the network also carried requests from DeepSeek and Xiaomi. Anthropic now works to attribute suspicious activity to the organisation behind a pool and enforce across the operation, rather than ban proxy accounts one at a time.

Anthropic also changed what the response exposed. Claude initially returned a summary of its reasoning instead of the full trace. In Anthropic's internal SWE-bench Verified experiment, a model trained on full Opus 4.8 transcripts scored 80.4%, against 71.8% for one trained on summarised transcripts. Attackers then tried to recover the hidden trace directly. In the Moonshot case, operators saved a reasoning signature, replayed it in a new session and induced Claude to reveal the associated reasoning.

On 12 October, Anthropic described the controls it added. Preserved thinking binds reasoning blocks to their permitted context and limits which models can read them. For new API accounts created on or after 31 August 2026, Claude Fable 5.1 and Opus 5.5 enforce a prefix check. The Claude API documentation specifies what that check covers: the system prompt, tools and messages before a thinking or redacted_thinking block must remain unchanged.

If the prefix is invalid, the API returns a 400 response or drops the block, depending on configuration. Older accounts can opt into the prefix check with thinking.block_binding.prefix_mismatch_behavior; the documented values are error and drop_block. Sonnet 5.5 also binds thinking blocks to the account that produced them. These controls interrupt cross-session, cross-model and cross-account reuse. They also require legitimate integrations to preserve conversation history correctly.

Anthropic added a two-stage classifier trained and tested against extraction attempts, including red-team examples. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic reports a false-positive rate below 0.1%. Repeated extraction attempts bring stricter account limits and, when persistent, bans. Since 24 September, Anthropic has also charged for requests blocked before a response in categories where it reports that false-positive rate.

The company reports a 10 to 100-fold reduction in reasoning tokens extracted on its own platform after the classifier. It says it has banned tens of thousands of accounts, often within two hours of a campaign starting. The controls also impose costs on legitimate customers: integration changes, occasional false blocks and charges for blocked requests.

The network layer still supplies evidence, but a residential IP, matching JA3 or valid phone number does not settle an account's identity. The comparison has to cross the pool. The US advisory calls out shared accounts using multiple IPs and user agents, consistent operational patterns across account pools, and new subscriptions immediately reaching maximum usage. It also recommends correlating activity across model providers, cloud platforms and API aggregators.

For a platform investigating a pool, payment instruments and sign-up details link accounts; IP and hosting history show shared infrastructure; timing and repeated request sequences show coordination. Those signals have to be assessed together. Closing a set of linked accounts in one action reduces the opportunity for traffic to move through the remaining pool. Our ban evasion guide covers how to connect accounts that return after enforcement. The token resale guide sets out the platform-log signals that pair with storefront evidence.

Where NoResponse fits

Identity Intelligence checks a new user's email, username or phone number against 2,000+ sources of identity data from 150 countries before the account's first request. The platform gets a decision on the evidence returned so far, or a pending answer. If additional evidence arrives later, a signed webhook delivers an update. This gives a platform more to assess than the document, selfie and phone number supplied at sign-up.

Relay Intelligence, coming soon, is being built to show which relays sell a platform's tokens, what they charge and which accounts and keys supply them. We track 70+ relay and resale services and the places where they advertise. Each reported relay will include its evidence, including the listing, price and observation time.

Behavioural Intelligence, also coming soon, will learn how accounts use the platform, link accounts with similar behaviour and identify keys that start acting like a pool. NoResponse does not make content-safety decisions. For a platform dealing with an active relay, incident support is available on request to help its team close a pool in one coordinated action.

Book a demo to see which relays list your models and what they charge.

Read next

• How API relays sell cheap Claude and GPT tokens at your expense

  A relay sells frontier models at a fraction of list price because someone else pays for the tokens. Usually that is you: the accounts, credits and keys in its pool are on your platform.

  Guide

• Token fraud on AI platforms and how to stop it

  Every token an AI platform serves runs on compute someone pays for. Token fraud is when the person using it is not the person you sold it to. This guide maps the four ways that happens and links to a guide for each.

  Guide

• How to stop free trial abuse on an AI platform

  Every free credit on an AI platform is compute someone pays for. Check each account before you grant credits, stage the credits and keep the card for accounts that raise a signal.

  Guide

Questions people ask

Why can a relay sell Claude or GPT tokens so cheaply?

Some relays draw on free sign-up credits, shared subscriptions, accounts opened under false details and stolen cards, or leaked keys. Others substitute a cheaper model. An advertisement reproduced by Okta Threat Intelligence in August 2026 quoted 5 to 15% of the official per-token price. For comparison, a study of authorised hosts of popular open-weight models found most priced within 5% of the official rate.

What is 降智 (intellect-dumbing)?

降智 is the Chinese term for a relay quietly serving a cheaper model than the one it billed for. In a CISPA audit accepted at ACM CCS 2026, 11 of 24 endpoints across three shadow APIs failed a model-fingerprint test. The paper found evidence consistent with substitution, and price did not reliably identify which model answered.

Are the prompts sent through a relay really harvested?

A relay has access to the prompts and responses it forwards. Anthropic's September 2026 threat report describes a case in which Moonshot forwarded customer requests to Claude and saved some of those exchanges for model training. The operator of an opaque relay controls its logs, so a customer cannot verify from the outside what it retains or sells.

How do account farms get past phone and ID verification?

SIM banks and virtual-number services sell one-time codes for under a cent. 404 Media documented AI-generated identity documents selling for about $15. Attackers also inject face-swap video into a virtual camera or an app's camera feed. iProov recorded a sharp rise in those attacks through 2024.

Can a platform tell when it is supplying a relay's pool?

Yes, from both ends. Inside your own data, look for accounts and keys that behave like many customers, share payment or sign-up details, or send traffic from the same hosting addresses. Outside it, search relay storefronts for your own model names and prices, then match what you find to the accounts you flagged.

Sources

1. How Chinese Sell 'Claude' Tokens at 5% Cost While Making MillionsHarshal Singh, author's website, 19 May 2026
2. China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI CompaniesCISA, NSA and FBI, joint advisory AA26-251A, 8 September 2026
3. Relaying to the FrontierScott Fisher, Team Cymru, 22 September 2026
4. Free tokens for sale: How fake signups drive AI fraudOkta Threat Intelligence, 4 August 2026, updated 3 September 2026
5. Real Money, Fake Models: Deceptive Model Claims in Shadow APIsYage Zhang and others, CISPA Helmholtz Center for Information Security; accepted at ACM CCS 2026
6. Countering misuse of AI: September 2026Anthropic, September 2026
7. Detecting and preventing distillation attacksAnthropic, 23 February 2026
8. Strengthening our defenses against distillation attacksAnthropic, 12 October 2026
9. Thinking and preserved thinkingAnthropic, Claude Platform documentation
10. Claude API pricingAnthropic, Claude Platform documentation
11. Reverse Engineering Claude Code's SSL Traffic with eBPFEunomia, 13 February 2026
12. Reasoning traces from Claude Opus 4.7lordx64, dataset documentation
13. Uncovering and Understanding Hidden Dependencies in the LLM API Reseller Ecosystem via Prefix-Cache Side ChannelsHong Kong University of Science and Technology, ETH Zürich and Zhejiang University; preprint, 21 August 2026
14. How to Buy Cheap Claude Tokens in ChinaZilan Qian, ChinaTalk, 5 May 2026
15. The Symbiosis of Residential Proxy Services and Malware EcosystemsBitsight TRACE, observation window 19 January to 15 March 2026
16. US govt sanctions cybercrime gang behind massive 911 S5 proxy botnetSergiu Gatlan, BleepingComputer, reporting the US Department of Justice and OFAC action, May 2024
17. Inside the Underground Site Where 'Neural Networks' Churn Out Fake IDsJoseph Cox, 404 Media, 5 February 2024
18. iProov Issues Annual Identity Verification Threat Intelligence ReportiProov, 27 February 2025, covering 2024 activity from its Security Operations Centre
19. JA3 TLS fingerprintingSalesforce, JA3 reference implementation
20. JA4+ network fingerprintingFoxIO, JA4+ specifications and implementations
21. Passive Fingerprinting of HTTP/2 ClientsElad Shuster and Ory Segal, Akamai, Black Hat Europe 2017
22. HTTP/2, RFC 9113IETF, June 2022
23. Machine Readable Travel Documents, Part 3International Civil Aviation Organization, Doc 9303, eighth edition
24. AI PingAI Ping, study of authorised hosts of open-weight models, May 2026