2026-07-30 13:45 UTCIn-site rewrite3 min readUpdated: 2026-07-30 14:02 UTC

The 73,000-server market reselling Western frontier AI into China

Infrawatch report uncovers a hidden market of 73,000 servers using 'transfer stations' to resell Western frontier AI into China. These gateways bypass the Great Firewall, pool API keys, and offer discounted access. The report highlights the accumulation of distillation data and the dominance of Chinese operators.

SourceHacker News AIAuthor: lloyddd

RESEARCH

Inside the 73,000-server market reselling Western frontier AI into China

12 mins read

Jul 30, 2026

Transfer stations by country

Resale and pooling gateways · new-api, sub2api, cli-proxy-api, one-api, 9router, chatgpt2api

Figure 5 - The same operators, billing panels and payment rails serve both product lines

The transport those panels sell is visible in the same scan. 10K servers run tooling used to cross the Great Firewall, most of it from the xray and sing-box family, with VLESS and Shadowsocks underneath.

Infrawatch classifies every one of those projects as suspicious. Every project in the AI gateway class is classified benign. The operators, the billing software, the payment rails and the customer are shared.

Higress

Higress is Alibaba’s open-source cloud-native gateway. It ships an AI gateway mode with provider routing, key pooling and token rate limiting, and we observe 2.2K exposed consoles. It is filed under software/infrastructure with no AI categorisation, so it appears in no AI gateway count, including our own.

We have excluded it from the census above because it is enterprise ingress software rather than resale tooling.

Data Retention

Every transfer station accumulates a distillation corpus as a by-product of running. Training a model on the outputs of a stronger one requires matched pairs of prompt and completion at scale. Provider terms forbid producing them, and the prohibition assumes the activity would surface in an account an investigator could inspect.

A transfer station accumulates exactly that material as a by-product of billing. Metering a customer requires reading the request leaving and the response returning. Counting tokens requires parsing both.

sub2api stores three fields for every request: the model the customer requested, the model actually served, and the chain of substitutions between them. Its authors named that field 模型映射链, model mapping chain. Researchers at CISPA tested 24 services of this type in March 2026 and found 45.8% served a model other than the one advertised.

The operator is not the only party who ends up holding a copy. This material accumulates on machines the provider cannot audit and does not know exist.

Assessment

Blocking by internet address did not reduce Chinese access to Western frontier models. It moved the market to a layer nobody was measuring, and Infrawatch assesses that with high confidence. The address is the cheapest component in the entire system to change, and changing it is the product these operators sell.

The discount is arbitrage, not crime, and we assess that with moderate confidence. Stolen accounts almost certainly circulate alongside it, and scanning cannot separate the two. But the pricing does not require theft to explain it, and treating this as a fraud problem misreads what is being sold.

We found no evidence that any operator is training on retained prompt and completion data. We also found no instrument by which a provider could establish otherwise. The material exists at scale, is retained by design, and sits with the operator rather than the provider, which means the absence of evidence here is a measurement limit rather than a finding.

Every layer of this market is Chinese: the software, the hosting, the certificates, the payment rails and the interface language. The model is the only component that is not, and the only one anyone attempted to restrict.

Conclusion

This market exists because the demand is real and the supply is trivially reconstructible. Neither of those facts changes if the 73K servers counted here disappear tomorrow.

Three forces point the same way. Distillation gives operators a reason to keep the prompt and completion pairs they already collect in order to bill. Every capable model release raises what a pooled subscription is worth to resell. And as Chinese regulation hardens around what domestic providers may serve, the distance between what is permitted locally and what developers actually want gets wider rather than narrower.

Infrawatch scans the internet continuously, revisiting more than 400 million services a day. Transfer station infrastructure is tracked under software/ai/llm-gateway and delivered as a feed or through the API, searchable by function, host, network and country.

Tracked Tags

Each population in this report resolves to a tag in the Infrawatch platform, queryable as tags: or by class as tags.category:"".

The ten largest resale and pooling detectionsRanked by service count

Tag