Add llm-subscription-resale-markets research topic

InferHub case study: subscription-entitlement resale, free-tier account
farming, proxy-pooled credential fleets, and the cheapest-wins auction that
prices them. Four files: index, analysis, sources, next-steps.

Evidence is public and unauthenticated only: InferHub terms/privacy/docs and its
public API (/api/openapi.json, /api/pricing/config, /api/market,
/api/pricing/usage, /api/status), the npm @inferhub/helper package, CodeBuddy's
own pricing/subscription docs, mastumbas.id, and
code.claude.com/docs/en/legal-and-compliance.

llm-subscription-resale-markets/analysis.md

@@ -0,0 +1,368 @@
+---
+title: Analysis — LLM Subscription-Resale Markets
+description: Mechanism deep-dive for the InferHub case — supply tiers, credential pipeline, quota windows, egress pooling, auction pricing, measured volume, reliability and risk surface.
+status: active
+category: market
+tags: [inference-market, subscription-arbitrage, free-tier-farming, credential-resale, supply-chain, tos-risk]
+draft: true
+created: 2026-10-05
+updated: 2026-10-05
+---
+
+# Analysis — LLM Subscription-Resale Markets
+
+> Part of [[llm-subscription-resale-markets/index|LLM Subscription-Resale Markets]]
+
+All captures unauthenticated and public. Claims labelled **VERIFIED** (observed in a capture
+whose URL and UTC timestamp are recorded), **INFERRED** (reasoned — reasoning given), **UNKNOWN**.
+
+## 1. What the platform actually is
+
+**VERIFIED** — `inferhub.dev/terms` §2 (last updated 2026-10-02):
+
+> "The Service is a reverse proxy and marketplace that resells access to upstream LLM
+> subscription entitlements, including subscriptions accessed via OAuth (such as Claude and
+> Codex), API-key-based plans (such as Command Code), and coding plans offered by third parties
+> (such as z.ai GLM Coding Plan and OpenCode Go). Publishers attach their own authorized upstream
+> subscriptions; consumers call the Service through OpenAI- and Anthropic-compatible endpoints
+> using an API key."
+
+It is a **two-sided market**: the platform owns no supply. Publishers list credentials; consumers
+deposit USDC and call an OpenAI/Anthropic-compatible API; the platform routes and takes 20%.
+
+**VERIFIED** — `GET /api/pricing/config` (public):
+
+```json
+{"maxAskPctOfOfficial":0.5,"platformFeePct":0.2,"publisherSharePct":80}
+```
+
+## 2. Supply: all 14 upstream families are subscriptions
+
+**VERIFIED** — `GET /api/market` (public, 200) carries a `family` per model. Complete list, with
+the model counts seen on the pricing page:
+
+| prefix | family | nature |
+|---|---|---|
+| `cc` | Claude Code | vendor subscription (OAuth) |
+| `cx` | OpenAI Codex | vendor subscription (OAuth) |
+| `zai` | Z.AI GLM Coding Plan | third-party coding plan |
+| `ocg` | OpenCode Go | third-party coding plan |
+| `cmc` | Command Code | API-key-based plan |
+| `cp` | ClinePass | third-party coding plan |
+| `cb` | CodeBuddy | coding-agent credits (Tencent) |
+| `cbcn` | CodeBuddy CN | coding-agent credits |
+| `ag` | Antigravity | Google free/IDE tier |
+| `ali` / `alicn` | Qwencloud/Alibaba (+CN) | cloud coding tier |
+| `mm` / `mmcn` | MiniMax (+CN) | coding tier |
+| `mimo` | Xiaomi MiMo | coding tier |
+
+Not one of them is a metered frontier API. This is the single most diagnostic fact about the
+business: **the gateway's supply is other people's flat-rate products.**
+
+## 3. Supply tier A — paid subscription arbitrage
+
+The arithmetic that produces the owner's headline number:
+
+`cc/claude-opus-5-5` in the market feed:
+
+```json
+{"slug":"cc/claude-opus-5-5","family":"Claude Code","minAskIn":0.796,"minAskOut":3.98,
+ "maxAskIn":2,"maxAskOut":10,"lastRate":0}
+```
+
+- Official reference: $4 /Mtok input.
+- Cheapest ask: **$0.796/Mtok = 80.1% off**.
+- Highest ask: **$2.00 = exactly the 50% cap.** The cap is a ceiling, not a floor.
+- `lastRate: 0` — the most recent settled rate on that slug was **zero**.
+
+**INFERRED (strong):** with a flat subscription already paid, a publisher's marginal cost per
+token is ~0, so any positive price is profit; the auction routes to the cheapest ask, so the
+rational publisher undercuts toward zero. The "80% discount" is therefore the *residual of a
+dumping auction*, not a purchase discount. It cannot be matched by any wholesale API deal,
+because the competitor's true cost is a sunk fee rather than a per-token price.
+
+## 4. Supply tier B — free-tier farming (the 99% rows)
+
+**VERIFIED** — InferHub's own public OpenAPI (`GET /api/openapi.json`, 138,946 bytes, 73 paths)
+documents bulk credential onboarding as a product feature. Quoted descriptions:
+
+- `POST /publisher/providers/antigravity/bulk` — *"Bulk-add Antigravity (Google) accounts from
+  refresh tokens. The body is the accounts payload itself… Each item needs a `refreshToken` (an
+  Antigravity access token lives about an hour, so the refresh token is the durable input);
+  `email` is optional and only names the row. Each account is refreshed for a live access token
+  and **onboarded onto a Cloud Code Assist project** before it is stored — accounts Google will
+  not onboard are reported as failures rather than saved."*
+- `POST /publisher/providers/codex/bulk` — same shape for Codex.
+- `POST /publisher/providers/codebuddy/refresh-tokens` — bulk OAuth refresh for CodeBuddy.
+- `POST /publisher/providers/recheck-bulk`, `GET /publisher/providers/invalid` — fleet-wide
+  credential health sweeps. The platform **expects credentials to die routinely**.
+- `GET /publisher/providers` — always paginated because *"a single publisher can own **six
+  figures of credentials**."*
+- `PATCH /publisher/providers/{id}/auto-reset-credit` — *"Toggle Codex auto reset-credit spend
+  (Codex only; **auto-spends real money**)."*
+- `GET /publisher/upstreams/{slug}/max-concurrent`, `.../schedule` — per-upstream concurrency and
+  scheduling.
+
+### 4.1 The vendor free tier being farmed
+
+**VERIFIED** — CodeBuddy (Tencent / "Buddy AI" international site), from its own pricing and
+subscription pages:
+
+| Plan | Price | Credits |
+|---|---|---|
+| Free | $0 | 100 credits/month |
+| Free daily activity bonus (limited-time) | $0 | +30 credits/day |
+| Free, new user | $0 | 250 credits on first sign-in, valid 14 days |
+| Pro | $10/mo ($96/yr) | 2,000/mo (1,000 base + 1,000 bonus), +50/day |
+| Pro 7-day trial | card + auto-renew | 500 credits |
+| Team | $40/seat/mo | 1,000/seat/mo |
+
+While the promotion runs, *"all models are available, code completion is unlimited, and up to 99
+automated tasks are included."* Base and bonus credits do **not** roll over month to month, and
+the daily bonus is "non-transferable, non-giftable, and cannot be exchanged for cash".
+
+⇒ **A fresh free account yields roughly 1,000 credits/month at zero cost.**
+
+**VERIFIED** — the vendor bans the method, in its own words (Subscription Policy, "Activity
+Restrictions" — rewards may be cancelled, reclaimed, and eligibility suspended):
+
+> "1. Participating using false, invalid, or non-personal account information;
+> 2. **Using scripts, plug-ins, emulators, API calls, bulk registration, or other means to farm
+> activity or rewards**;
+> 3. Exploiting system vulnerabilities, network abnormalities, or technical faults for improper gain;
+> 4. **Maliciously creating or controlling multiple accounts to participate**;
+> 5. Violating Buddy AI's terms of service, subscription rules, credit usage rules, or applicable
+> laws and regulations; …"
+
+and in the FAQ: *"…users may not obtain improper rewards through **bulk registration, account
+sharing, account trading**, or other abnormal methods."*
+
+**VERIFIED** — geographic control: `www.codebuddy.ai` does not resolve from US, Indian or Russian
+networks (DNS answers `0.0.0.1` to client subnets there). The resale market routes around it.
+
+### 4.2 The credential market that supplies it
+
+**VERIFIED** — `mastumbas.id/product/codebuddy`, an Indonesian digital-goods marketplace (QRIS /
+local rails, "Made in Indonesia"):
+
+- "Codebuddy Global 480-500++Credit [BERGARANSI] (Auto Claim Harian +30 Credit Daily)", store
+  **Dudul**, listed Rp 123,456 → **Rp 2,300 (≈ $0.14)**, **3,303 sold**, stock 720, 2-day
+  warranty, 48 reviews at 5.0.
+- Wholesale: ≥10 Rp 2,200 · ≥20 Rp 2,100 · ≥30 Rp 2,000 · ≥50 Rp 1,900 · **≥100 Rp 1,800/pc**.
+  (100 accounts ≈ Rp 180,000 ≈ $11.)
+- Seller's description: *"1 token = 1 CodeBuddy account containing 450 credits, usable in 9router
+  for 28 AI models: text, coding, image and video. Credits increase +30 per day automatically as
+  long as the account is still active."* Delivery = **access token + refresh token** as a `.json`.
+- Adjacent listings on the same page: Cline accounts (Rp 2,000, "limit per model 10–15 M tokens
+  daily, auto reset 24 h") → `cp/`; "Refresh Token Codebuddy CN 4000-5000 Credit" (Rp 15,000) →
+  `cbcn/`; "Apikey Codebuddy Global 30000 Credit" (Rp 100,000); a CodeBuddy-CN listing attributed
+  to **rdhx** (the operator named in the earlier free-token-gateway study); Gemini Pro links; and
+  1-day **Webshare** proxy packs. Account supply and proxy supply on the same shelf.
+
+**VERIFIED (set comparison)** — InferHub `cb/` slugs vs the 28 model codes that listing
+advertises: **19 exact matches of InferHub's 23**.
+
+```
+claude-opus-4.6  claude-opus-4.7-1m  deepseek-v4.1-flash  gemini-2.5-flash-image
+gemini-3.1-flash-image  gemini-3.1-pro  glm-5.2  glm-5.3  gpt-5.3-codex  gpt-5.4  gpt-5.5
+gpt-5.6-luna  gpt-6-astra  gpt-6-sol  gpt-image-2  grok-4.6  grok-4.7  hy4-preview  kimi-k3
+```
+
+InferHub-only: `claude-opus-5`, `gemini-3.0-pro-image`, `gpt-6-luna`, `minimax-m3`.
+Listing-only: `gemini-3.5-flash`, `gemini-3.8-flash`, `glm-5.3-flash`, `gpt-5.6-sol`,
+`gpt-5.6-terra`, `hy3`, `kimi-k2.6`, `kimi-k2.8-preview`, `seedance-2.5`.
+
+⇒ InferHub asks **$0.04/Mtok** for `cb/claude-opus-4.6` and `cb/claude-opus-4.7-1m` — 99.2% off an
+official $5 — and that capacity is reachable through a ~$0.14 account from this market.
+
+**INFERRED (not asserted as fact):** that MasTumbas supply specifically feeds InferHub. What is
+verified is that InferHub names the family "CodeBuddy", ingests bulk CodeBuddy refresh tokens, and
+serves the same model-code set; MasTumbas is a public example of the supply, not proven to be the
+identical accounts.
+
+## 5. Routing and failure semantics
+
+**VERIFIED** — `inferhub.dev/docs`, "Routing tips":
+
+- *"Auto routing: The router picks the best publisher serving that prefix per request, falling
+  over to another on failure (up to 5 hops)."*
+- `429 capacity_saturated` (Anthropic envelope `rate_limit_error`, `Retry-After: 2`) when every
+  provider for a model is at its concurrency limit. Nothing billed.
+- *"Quotas: If every publisher serving a prefix has hit their plan's monthly cap, we return
+  `503 no_capacity` until any of their periods rolls over."*
+- `402 no_provider_under_bid` with `min_input_per_mtok` / `min_output_per_mtok` when no provider
+  meets a consumer's bid headers.
+- `x-ignore-upstream: cmc,qd,cx` — a prefix exclusion list that also reveals an unlisted `qd`
+  (Qoder) prefix.
+- Model addressing: `<prefix>/<model>` (e.g. `ocg/glm-5.2`), a bare alias (cheapest-first across
+  members), `combo/<slug>`, or `free/<slug>/<model>`.
+- Minimum charge $0.00001 per billed request; failed requests, no-output requests and free models
+  cost $0.
+
+**Quota modelling:** the home page states *"We poll Claude, Codex, and z.ai for live 5-hour and
+weekly usage windows. No manual caps — exhaustion is detected from the source of truth."* Together
+with the `usage-windows` provider sub-resource and `auto-reset-credit`, this reads as: the platform
+authenticates to the **vendor's own usage/limit API** with the publisher's OAuth token and tracks
+each credential's 5-hour and weekly windows, skipping exhausted ones. **INFERRED** for the
+internal detail; **VERIFIED** that quota windows are polled and surfaced.
+
+## 6. The egress layer
+
+**VERIFIED** — platform copy: *"Per-provider outbound proxy pool routes your traffic through
+least-used egress."*
+
+**VERIFIED** — the owner-supplied Discord screenshot (`owner-proxy.png`) is a proxy-vendor
+dashboard: "1,000 Proxies", "∞ GB bandwidth/month", start "24 Sep 2026 16:23", "2,866,045 Total
+Requests", "4.4 TB / ∞ GB Total Bandwidth used". Posted by handle **ExZork** answering *"penasaran
+sama bandwith usage proxinya inferhub ngehandle puluhan ribu akun"* — "curious about the proxy's
+bandwidth, InferHub handles tens of thousands of accounts."
+
+**INFERRED:** spreading many accounts across many egress paths prevents both rate-limit
+correlation and the vendor's own proxy/VPN detection (Anthropic is documented as detecting
+datacenter-range traffic). The same marketplaces that sell the accounts also sell the proxies.
+
+## 7. Measured scale
+
+**VERIFIED** — `GET /api/pricing/usage` (public), window `2026-10-04T19:30Z → 2026-10-05T19:37Z`:
+**152 routable slugs, 5,684,357 requests, 406,505,881,779 input tokens** (333.3 bn cached = 82.0%),
+**9,616,677,225 output tokens**.
+
+| family | requests | input tokens | tier |
+|---|---|---|---|
+| CodeBuddy (`cb/`) | 2,843,337 | 266.8 bn | free-tier credits |
+| CodeBuddy CN (`cbcn/`) | 1,972,650 | 92.1 bn | free-tier credits |
+| OpenAI Codex (`cx/`) | 343,683 | 15.9 bn | subscription |
+| Antigravity (`ag/`) | 156,661 | 6.1 bn | Google free/IDE tier |
+| Qwencloud/Alibaba (`ali/`) | 155,240 | 10.9 bn | cloud coding tier |
+| Qwencloud/Alibaba CN (`alicn/`) | 93,010 | 5.0 bn | cloud coding tier |
+| Z.AI GLM (`zai/`) | 48,603 | 4.1 bn | subscription |
+| **Claude Code (`cc/`)** | **32,249** | **2.77 bn** | subscription |
+| MiniMax (`mm/`) | 21,573 | 1.57 bn | coding tier |
+| Command Code (`cmc/`) | 7,430 | 0.28 bn | subscription |
+| OpenCode Go (`ocg/`) | 5,990 | 0.64 bn | subscription |
+| ClinePass (`cp/`) | 3,636 | 0.30 bn | subscription |
+| Xiaomi MiMo (`mimo/`) | 181 | 3.0 M | coding tier |
+| MiniMax CN (`mmcn/`) | 114 | 6.0 K | coding tier |
+
+**CodeBuddy alone is 50% of requests and 66% of input tokens. Claude Code is 0.57%.** The
+flagship-discount rows are marketing surface; the throughput is farmed free-tier commodity
+capacity. Largest single slug: `cb/deepseek-v4.1-flash`, 2,434,748 requests, 242 bn input tokens.
+
+**VERIFIED** — pricing page headline counts: **14 curated upstreams, 155 routable model IDs,
+74,310 active providers** (marketplace supply). One Claude slug (`claude-opus-4.7`) shows 6,758
+available slots.
+
+## 8. Reliability and latency
+
+**VERIFIED** — `GET /api/status` (public): overall 24 h availability 99.6%, 7 d 99.59%; **API
+availability 24 h 96.4%**. API error causes: **no_capacity 62.7%**, upstream_failed 37.2%,
+billing_unavailable 0%.
+
+Auto-route alias availability: `claude-fable-5` **35.07%** over 24 h (currently degraded at
+82.35%); `claude-fable-5.1` **major_outage**, 27.5% current.
+
+| prefix | family | avail 24 h | p50 | TTFT 1 h | tok/s |
+|---|---|---|---|---|---|
+| `cp` | ClinePass | 93.10% | 7.5 s | 5.0 s | 62.8 |
+| `alicn` | Qwencloud/Alibaba CN | 96.72% | 30 s | 18.1 s | 27.2 |
+| `cx` | OpenAI Codex | 96.84% | 15 s | 8.5 s | 23.6 |
+| `cc` | Claude Code | 97.71% | 5 s | 5.1 s | 42.0 |
+| `cmc` | Command Code | 98.30% | 60 s | 8.6 s | 39.6 |
+| `ali` | Qwencloud/Alibaba | 98.90% | 7.5 s | 5.0 s | 41.7 |
+| `ocg` | OpenCode Go | 99.48% | 15 s | 8.4 s | 24.7 |
+| `zai` | Z.AI GLM Coding Plan | 99.50% (degraded) | 15 s | 18.7 s | 24.3 |
+| `ag` | Antigravity | 99.78% | 7.5 s | 10.6 s | 73.9 |
+| `mm` | MiniMax | 99.84% | 7.5 s | 4.6 s | 38.2 |
+| `cb` | CodeBuddy | 99.85% | 7.5 s | 11.5 s | 115.2 |
+| `cbcn` | CodeBuddy CN | 99.98% | 10 s | 5.9 s | 39.0 |
+
+First-token times of 5–19 s and a 3–7% failed-request rate are not first-party API
+characteristics. **INFERRED:** the discount is paid for in availability and latency, and a
+capacity-constrained pool is the binding constraint (no_capacity dominating the error mix).
+
+## 9. Risk surface
+
+**VERIFIED (policy text)** — InferHub privacy policy:
+
+- On an upstream security-policy rejection, the **system prompt, tool definitions and request
+  parameters** of that request are retained **7 days** ("the scaffolding of that one request").
+- Safety screening reads the consumer's messages and system prompt against a keyword/pattern list
+  **before** sending upstream, expressly *"to keep content prohibited by our Acceptable Use terms
+  (material involving minors, and malicious tooling) **off the provider accounts that serve
+  you**"* — i.e. the pooled provider accounts are the asset being protected. Flagged text is
+  retained **14 days**, rule/score metadata **90 days**. Tool results, file contents and
+  attachments are excluded.
+- Publisher credentials (API keys, OAuth refresh tokens, outbound proxy credentials) are stored
+  **AES-256-GCM** encrypted (`api_key_enc`, `oauth_refresh_enc`) and decrypted *"only in-process,
+  in memory, when a request is routed"*.
+
+**VERIFIED (docs):** some upstreams *"add to or reshape your system prompt (for example, Cursor
+prepends its own agent prompt)"* — surfaced as `systemPromptNote` from `GET /api/catalog`.
+A publisher's agent scaffolding can therefore land inside a consumer's request.
+
+**INFERRED:** (a) plaintext credentials exist in the operator's process memory, so a host
+compromise or a rogue operator exposes live vendor credentials for every connected subscription;
+(b) consumers cannot verify which credential served them, so a substituted backend is not
+detectable from the outside.
+
+**VERIFIED** — Terms of Service posture: §7 puts every upstream-ToS obligation on the publisher
+("represent and warrant" authority; "solely responsible" for compliance "including any
+restrictions on shared, transferred, or resold access"; indemnify InferHub). §8: balances are
+**non-refundable** and a chargeback forfeits the whole balance. §6: paid capacity may be resold,
+**free-pool capacity may not**. §10: no warranty on output rights.
+
+## 10. Legal exposure (the landing vendor's own words)
+
+**VERIFIED** — `code.claude.com/docs/en/legal-and-compliance`:
+
+> "Customers may not pay for, resell, or **intermediate Claude usage on their end users'
+> behalf**. Each end user must authenticate with their own Anthropic API key, Claude subscription
+> plan credentials, or 3P inference provider credential…"
+
+> "Anthropic does not permit third-party developers to offer Claude.ai login into their own
+> applications, or to **route requests through Free, Pro, or Max plan credentials on behalf of
+> their users**. Moreover, developers may not **collect, store, or intermediate Claude.ai
+> credentials or session tokens** — sign-in to a Claude account must complete through Anthropic's
+> own flow."
+
+For the Claude Code upstream, InferHub does all three at once. **INFERRED:** the platform's
+indemnity chain (publisher warrants authority; publisher indemnifies) cannot extinguish the
+upstream's own prohibition — it only reallocates who pays. Secondary sources report enforcement
+tightening through 2026 (subscription tokens blocked in third-party harnesses), which is
+consistent with the platform's need for 1,000 rotating proxies and its `invalid` /
+`recheck-bulk` sweep endpoints. **UNKNOWN:** whether any specific publisher or consumer has been
+banned (deep lane pending).
+
+## 11. Model-substitution risk
+
+**INFERRED, literature-supported.** The same market is the subject of black-box auditing work:
+*"Which Model Is Actually Serving You? IRIS: Budgeted Black-Box Auditing of Model Substitution and
+Routing Dilution in LLM Gateways"* (arXiv 2607.20860) and *"Your 'Pro' LLM Subscription May
+Actually Be 'Free': Exposing Fingerprint Spoofing Risks in LLM Inference Services"*
+(arXiv 2606.16100). Both treat "the served backend may not match the advertised one" as a known
+property of commercial gateways. Combined with settling prices at 0.1–1% of official on
+free-tier families, substitution or mislabelling **cannot be excluded from public data**.
+**UNKNOWN** for InferHub specifically — settling it needs a paid account plus a fingerprint audit,
+which is outside the passive scope.
+
+## 12. This is a category, not an original
+
+- **Surplus Intelligence** (`surplusintelligence.ai`) — *"Open Market for Models: your API calls
+  routed to the cheapest offer, your surplus capacity sold to the highest bidder"*, with "list
+  your API credits" as the seller path; Base-native with a `SURPLUS` token (116.5 bn LLM tokens
+  reported through that ecosystem per a public project page).
+- **inferencehub.tech** — same niche; its own comparison copy places "**Gray-market supply ·
+  Start in minutes**" opposite "Real supply through hyperscaler and enterprise channels", and
+  states plainly "We're not cheaper than the labs."
+- **FreeLLMAPI** — aggregates 34 free providers / 635 endpoints, claims 7.4 bn tokens/month.
+- **OmniRoute** — peer gateway that **publishes a ToS table naming 15 providers whose terms
+  prohibit proxy access**, i.e. the community documents its own prohibited-use footing.
+- The **September 2026 study** (`RESEARCH/free-token-gateways/`) found four separate operations
+  doing the operator-run version of the same thing, with first-party admission of bulk account
+  creation, one-account-per-proxy signup, and edu-mail resale inside the operator's own community.
+
+**Conclusion of the analysis:** the cheap-frontier-model product is a **credential logistics
+business dressed as an API company**. Its cost base is other people's flat-rate entitlements and
+free tiers; its moat is the operational machinery (bulk onboarding, token refresh, quota polling,
+egress rotation, failover) rather than any supply relationship; and its main risk is that the
+landing vendors actively prohibit the arrangement.

llm-subscription-resale-markets/index.md

@@ -0,0 +1,86 @@
+---
+title: LLM Subscription-Resale Markets
+description: How "one API key, every frontier model" gateways sell Claude/GPT at 80–99.9% off — subscription-entitlement resale, free-tier account farming, proxy-pooled credential fleets, and the auction that prices it. Primary case: InferHub (inferhub.dev).
+status: active
+category: market
+tags: [inference-market, subscription-arbitrage, gray-market, free-tier-farming, credential-resale, supply-chain, tos-risk, codebuddy, inferhub, usdc]
+draft: true
+created: 2026-10-05
+updated: 2026-10-05
+origin: buzz://d8a718be-031f-4a6e-9f5c-a55466641654/51d7492cdba77ffc37bde707ab87d950a450debdb2ab50d288ffec778d6f93bd
+---
+
+# LLM Subscription-Resale Markets
+
+## Summary
+
+A class of inference gateways sells frontier-model access far below the vendor's list price (80% off on a Claude subscription family, up to 99.9% off on others). They do not buy tokens from the model vendors and they do not have a wholesale deal. They operate a **two-sided market for other people's subscription entitlements and free-tier credits**, priced by a cheapest-wins auction, and they route the traffic through pooled credentials fronted by rotating egress proxies.
+
+Primary case studied: **InferHub** (`inferhub.dev`), a USDC-on-Solana marketplace with 74,310 listed active providers, 155 routable model IDs, and 5.68 M requests / 406.5 bn input tokens measured over one 24-hour window.
+
+## Research Question
+
+How can a third-party gateway serve frontier Claude/GPT/Gemini models at 80% or more below the vendor's official per-token price — and what does that architecture imply for the people buying and selling through it?
+
+## Scope
+
+**Included:** the supply side (where the capacity comes from), the routing/auction mechanism, the credential-ingestion pipeline, the measured scale, the reliability profile, and the terms-of-service/legal exposure for both sides of the market.
+
+**Excluded:** attempting to authenticate, testing any credential, exploiting any endpoint, and black-box model-fingerprinting (needs a paid account — left as a next step).
+
+**Sufficient answer:** the supply mechanism is identified and its chain traced to a concrete, purchasable artefact, with the decisive claims backed by first-party or vendor-primary sources.
+
+**Method:** passive, unauthenticated reconnaissance only. Public pages, public JS/CSS, public API schemas and unauthenticated error responses, public marketplaces, DNS, npm, public code hosts. No account created, no key sent, no auth bypassed, ~1 s pacing.
+
+## Key Findings
+
+- **The model is subscription resale, admitted in the operator's own terms.** InferHub's ToS §2: *"a reverse proxy and marketplace that resells access to upstream LLM subscription entitlements, including subscriptions accessed via OAuth (such as Claude and Codex), API-key-based plans (such as Command Code), and coding plans offered by third parties (such as z.ai GLM Coding Plan and OpenCode Go)."*
+- **All 14 upstream families are consumer coding-agent subscriptions, not metered APIs.** `GET /api/market` (public) returns a `family` per model: CodeBuddy, CodeBuddy CN, Command Code, OpenCode Go, ClinePass, Claude Code, OpenAI Codex, Qwencloud/Alibaba (+CN), Antigravity (Google), MiniMax (+CN), Z.AI GLM Coding Plan, Xiaomi MiMo.
+- **The discount is auction clearing price, not a purchase discount.** `GET /api/pricing/config` returns `{"maxAskPctOfOfficial":0.5,"platformFeePct":0.2,"publisherSharePct":80}`: a publisher ask is capped at 50% of official, and competition between publishers pushes it far below the cap, because the seller's marginal cost is approximately zero once the flat subscription is paid.
+- **There are two distinct supply tiers under one roof**, and they are different businesses:
+  - **Paid subscription arbitrage** (`cc/` Claude Code, `cx/` Codex, `zai/`, `ocg/` OpenCode Go, `cmc/` Command Code, `cp/` ClinePass) — a real sunk monthly cost per account. This is the tier that produces the owner's headline 80% figure: `cc/claude-opus-5-5` asks $0.796/Mtok against official $4.
+  - **Free-tier / promo-credit farming** (`cb/` CodeBuddy, `cbcn/`, `ag/` Google Antigravity, `ali*/`) — acquisition cost is one account signup, and on the secondary market ~$0.11–0.14 per account. This is the tier that produces the 99% rows.
+- **Free-tier farming is productised as a platform feature.** InferHub's public OpenAPI documents `POST /publisher/providers/antigravity/bulk` — *"Bulk-add Antigravity (Google) accounts from refresh tokens … each account is refreshed for a live access token and **onboarded onto a Cloud Code Assist project**"* — plus `*/codex/bulk`, `*/codebuddy/refresh-tokens`, `*/recheck-bulk`, `*/invalid`, `*/usage-windows` and `*/auto-reset-credit` ("Codex only; auto-spends real money"). A single publisher is documented as able to hold "six figures of credentials".
+- **A concrete, purchasable artefact sits at the bottom of the chain.** Indonesian marketplace `mastumbas.id` sells CodeBuddy accounts — access token + refresh token, 450 starting credits, +30 credits/day auto-claim — at **Rp 2,300 (~$0.14)** retail, Rp 1,800 at ≥100 units, 3,303 sold. Cline accounts, CodeBuddy-CN refresh tokens and 1-day Webshare proxy packs sell on the same shelf.
+- **Decisive link (slug correspondence, VERIFIED):** 19 of InferHub's 23 `cb/` slugs match that listing's advertised model codes exactly, including `claude-opus-4.6` and `claude-opus-4.7-1m` — which InferHub asks **$0.04/Mtok** for against an official $5, i.e. 99.2% off. That capacity is reachable through a $0.14 account, not through any arrangement with Anthropic.
+- **The vendor's free tier is the engine: ~1,000 credits/month at zero cost.** CodeBuddy Free = 100 credits/month + 30 credits/day (limited-time daily-activity bonus) + 250 welcome credits; all models available while the promotion runs. Tencent bans exactly this in its own subscription policy (*"scripts, plug-ins, emulators, API calls, bulk registration, or other means to farm activity or rewards"*; *"maliciously creating or controlling multiple accounts"*; *"bulk registration, account sharing, account trading"*).
+- **The volume is in the cheap commodity tier, not the flagships.** CodeBuddy is **50% of all requests and 66% of all input tokens**; the real Claude Code family is **0.57% of requests**. The 80%-off Claude row is the shop window.
+- **The landing terms forbid the business model outright.** Claude Code's own legal & compliance page: *"Customers may not pay for, resell, or intermediate Claude usage on their end users' behalf"* and developers *"may not collect, store, or intermediate Claude.ai credentials or session tokens"*. InferHub does all three for the Claude Code upstream.
+- **Consumers pay for the cheapness in failure rate and latency, and in data exposure.** API availability 24 h **96.4%**, with error causes no_capacity 62.7% / upstream_failed 37.2%; TTFT 5–19 s; `claude-fable-5` auto-route at **35%** 24 h availability. InferHub's privacy policy retains the consumer's **system prompt and tool definitions for 7 days** on security-policy rejections, retains screened message text for 14 days, and documents that some upstreams **prepend their own agent prompt** to the consumer's request.
+- **The mechanic is a category, not an original.** Surplus Intelligence runs the same open market on Base rails ("your surplus capacity, sold to the highest bidder"); `inferencehub.tech` in the same niche labels the sector "**gray-market supply**" in its own comparison copy; FreeLLMAPI aggregates 34 free providers; OmniRoute publishes a ToS table of 15 providers whose terms prohibit proxy access.
+
+## Sources
+
+Full reference list with per-source context: [[llm-subscription-resale-markets/sources|Sources]].
+
+Decisive ones: InferHub `/terms`, `/privacy`, `/docs`, `/faq`, `/api/openapi.json`, `/api/pricing/config`, `/api/market`, `/api/pricing/usage`, `/api/status`; `code.claude.com/docs/en/legal-and-compliance`; `codebuddy.ai` pricing/subscription docs; `mastumbas.id/product/codebuddy`; npm `@inferhub/helper`.
+
+## Detail Files
+
+- [[llm-subscription-resale-markets/analysis|Analysis]] — the mechanism in full: supply tiers, the auction, the credential pipeline, quota windows, egress pooling, measured volume, reliability, risk surface
+- [[llm-subscription-resale-markets/sources|Sources]] — every reference, with what it evidenced
+- [[llm-subscription-resale-markets/next-steps|Next Steps]] — open questions and the evidence that would settle them
+
+## Related Research
+
+- **Prior study, workspace only:** `RESEARCH/free-token-gateways/` (2026-09-15) — the operator-run version of the same supply (pooled CodeBuddy/free-tier accounts, bulk email + proxies + stealth browser, custom gateway; LiteLLM falsified). Four separate operations, no shared operator.
+- **Workspace raw material for this topic:** `RESEARCH/inferhub-marketplace/` — `ORCHESTRATOR_INVESTIGATION.md`, `SUPPLY_CHAIN_CODEBUDDY.md`, `RECON_NOTES.md`, raw captures under `.scratch/EVIDENCE/`.
+
+## Discussion
+
+Raised by **brutaljokerz** in `#research` on 2026-10-05 while looking at `inferhub.dev/pricing` ("how does it serve models very cheap especially opus 5.5, frontier at 80% discount?"), with an operator-posted screenshot of a proxy-vendor dashboard (1,000 proxies, 4.44 TB, 2.87 M requests since 24 Sep 2026) posted by Discord handle **ExZork** in reply to a question about the platform "handling tens of thousands of accounts".
+
+Follow-up in the same thread connected it to the September free-token-gateway study and to the CodeBuddy-account resale market; the operator's npm package `@inferhub/helper` carries maintainer `exzork`, which matches the Discord handle. The platform describes itself as "operated by its developer as an individual"; the jurisdiction is not disclosed.
+
+Operator screenshot retained at `RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/owner-proxy.png`.
+Thread: `buzz://d8a718be-031f-4a6e-9f5c-a55466641654/51d7492cdba77ffc37bde707ab87d950a450debdb2ab50d288ffec778d6f93bd`
+
+## Next Steps
+
+- [ ] Fold in the three deep lanes still running at time of writing (credential/quota mechanism, GMV economics with the two-tier split, and the remaining 13 vendors' upstream clauses)
+- [ ] Owner to add additional material in-thread
+- [ ] Decide `draft: false` if this goes to the public Quartz site
+
+## Conclusion
+
+Open — `status: active`. The supply mechanism is settled; the economics quantification and the enforcement record are not.

llm-subscription-resale-markets/next-steps.md

@@ -0,0 +1,104 @@
+---
+title: Next Steps — LLM Subscription-Resale Markets
+description: Open questions for the subscription-resale inference market study, and the evidence that would settle each one.
+status: active
+category: market
+tags: [inference-market, open-questions]
+draft: true
+created: 2026-10-05
+updated: 2026-10-05
+---
+
+# Next Steps — LLM Subscription-Resale Markets
+
+> Part of [[llm-subscription-resale-markets/index|LLM Subscription-Resale Markets]]
+
+## Open questions, and what would settle each
+
+### 1. Economics — how big is this, and does anyone make money?
+
+**Open:** marketplace gross volume per day in USDC; the price distribution per family vs official
+list; whether the observed clearing prices are above or below a publisher's real cost in the paid
+tier; the operator's 20% take; what a publisher earns per day at observed clearance prices.
+
+**What settles it:** arithmetic over two already-public feeds (`/api/pricing/usage` tokens ×
+`/api/market` asks), computed separately for the paid-subscription tier and the free-tier tier.
+The blended figure is misleading because the tiers have different cost structures — tier B's
+acquisition cost is ~$0.11–0.14 per account with ~450 banked credits, tier A's is a monthly fee.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 2. Mechanism — the credential and quota model in full
+
+**Open:** the exact scoring/selection function behind "best-scoring provider"; how a usage window
+is represented and refreshed; what `auto-reset-credit` spends and when; how `combo/<slug>` and
+bare aliases resolve to members; whether a consumer can observe which credential served them.
+
+**What settles it:** the public OpenAPI schema for `/publisher/providers`,
+`/publisher/providers/{id}/usage-windows`, `/publisher/upstreams/{slug}/*`, plus the public JS
+bundles under `/_next/static/chunks/`. Some of this is consumer-visible only with an account.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 3. The other 13 vendors' clauses
+
+**Open:** whether the same prohibition that Anthropic states explicitly also exists, quoted, for
+OpenAI (ChatGPT/Codex), Google (Gemini Code Assist / Antigravity / Cloud Code Assist), z.ai GLM
+Coding Plan, Cline, CodeBuddy, Command Code, OpenCode Go, MiniMax, Xiaomi MiMo and Alibaba/Qwen.
+
+**What settles it:** the vendor's own terms / usage policy / acceptable-use page for each, quoted
+verbatim with a URL and access date. **A well-evidenced "no clause found in the sources I could
+reach" is a valid result**, not a failure.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 4. Enforcement record
+
+**Open:** has any publisher actually lost a subscription for connecting it, and has any consumer
+lost access? Is there any public review, complaint or ban report naming inferhub.dev or the
+operator handle?
+
+**What settles it:** public reporting, Reddit / HN / X / Discord-indexed discussion, GitHub
+issues, and the project's own community. Absence is itself a finding, but only after a documented
+search.
+
+### 5. Operator and jurisdiction
+
+**Open:** the operator is described in their own terms as an individual, with the jurisdiction of
+residence undisclosed; the data controller is that individual. QRIS / IDR pricing points at an
+Indonesian-facing operation and the npm maintainer handle matches the Discord handle that posted
+the proxy dashboard.
+
+**What settles it:** only the operator can confirm. Treat as **UNKNOWN** and do not infer
+nationality from payment rails. Any further attribution stops at what the operator publishes
+himself; no personal data beyond the public professional profile belongs in this vault.
+
+### 6. Model substitution — the one question public data cannot answer
+
+**Open:** are the frontier-labelled rows actually the labelled models, or a cheaper backend behind
+a frontier model name? At 0.1–1% of official on free-tier families this cannot be excluded from the
+outside.
+
+**What settles it:** a paid account plus a black-box fingerprint audit in the shape of the IRIS /
+fingerprint-spoofing literature, measuring the served backend rather than trusting the model
+string. **Outside the passive scope of this study** and not authorised. If it is ever run, it must
+be a deliberate, bounded test — not incidental probing.
+
+### 7. Consumer-side viability
+
+**Open:** is the discount actually usable work? Measured 24 h API availability of 96.4% with
+`no_capacity` at 62.7% of errors, 5–19 s TTFT, and one flagship alias at 35% availability suggest
+the answer depends heavily on the model and the hour.
+
+**What settles it:** a metered, time-boxed trial of a single consumer balance against a first-party
+API on the same workload — cost per completed task, not cost per token. Requires spending money and
+an account; needs explicit owner approval first.
+
+## Housekeeping
+
+- [ ] Fold the three deep lanes into `analysis.md` when their verified versions arrive, and update
+      the `updated:` field
+- [ ] Owner will add additional material in the Buzz thread — append rather than rewrite
+- [ ] Decide `draft:` flag if this topic should appear on the public Quartz site
+- [ ] Cross-link the September `RESEARCH/free-token-gateways/` study once it is vaulted (it is
+      currently workspace-only)

llm-subscription-resale-markets/sources.md

@@ -0,0 +1,101 @@
+---
+title: Sources — LLM Subscription-Resale Markets
+description: Reference list for the subscription-resale inference market study, with what each source evidenced.
+status: active
+category: market
+tags: [inference-market, sources]
+draft: true
+created: 2026-10-05
+updated: 2026-10-05
+---
+
+# Sources — LLM Subscription-Resale Markets
+
+> Part of [[llm-subscription-resale-markets/index|LLM Subscription-Resale Markets]]
+
+All accessed 2026-10-05, unauthenticated. Web pages fetched between 19:37 and 20:05 UTC; raw
+captures with URL + UTC timestamp provenance are kept in the workspace at
+`RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/`.
+
+## InferHub — first-party pages (the target of the study)
+
+| Source | What it evidenced |
+|---|---|
+| `https://inferhub.dev/terms` (last updated 2026-10-02) | §2 self-description as a *subscription-reselling reverse proxy and marketplace*; §5 acceptable use; §6 paid-vs-free resale rules; §7 publisher warranties + indemnity; §8 non-refundable balances and chargeback forfeiture; §10 no output-rights warranty |
+| `https://inferhub.dev/privacy` (last updated 2026-06-17) | credential storage model (`api_key_enc`, `oauth_refresh_enc`, AES-256-GCM, in-process decrypt); 7-day retention of system prompt + tool definitions on security-policy rejection; 14-day retention of screened message text; the "keep content … off the provider accounts that serve you" screening rationale; sub-processors (PostgreSQL, Redis, NATS, Solana RPC, Cloudflare); data controller = the individual operator, jurisdiction undisclosed |
+| `https://inferhub.dev/` | publisher pitch; "Real upstream quota tracking … live 5-hour and weekly usage windows"; "Per-provider outbound proxy pool routes your traffic through least-used egress"; live market ticker with per-slug asks (e.g. `cc/claude-opus-5-5 ask $0.8`); "Models reachable without buying the plan" table |
+| `https://inferhub.dev/pricing` | full model table with official reference prices and per-tier asks/avail; the 50%-of-official cap statement; platform headline counts (14 upstreams / 155 model IDs / 74,310 active providers); minimum charge $0.00001; cache-badge definition |
+| `https://inferhub.dev/faq` | "pools upstream LLM subscriptions … behind a single OpenAI- and Anthropic-compatible API"; bcrypt/argon2id/AES-256-GCM claims; publisher obligations |
+| `https://inferhub.dev/docs` | routing tips: auto-routing with up to 5 hops; `429 capacity_saturated`; `402 no_provider_under_bid`; `503 no_capacity` on monthly caps; `x-ignore-upstream` (reveals the unlisted `qd` prefix); the `systemPromptNote` / "Cursor prepends its own agent prompt" statement; `free/<provider>/<model>` naming |
+| `https://inferhub.dev/docs/api` | three surfaces on one `sk-airo-` key: inference (`api.inferhub.dev`), management REST API, MCP SSE at `/mcp/sse`; `combo/<slug>` routing |
+| `https://inferhub.dev/docs/api/reference` | rate limits (30 rpm management / 500 rpm inference per account); model-name formats; minimum-charge worked example; `account_blocked` semantics |
+| `https://inferhub.dev/status` | status page shell (JSON is at `/api/status`) |
+| `https://inferhub.dev/refund-policy` | non-refundable balance policy |
+
+## InferHub — public API surface (no auth required)
+
+| Endpoint | Response | What it evidenced |
+|---|---|---|
+| `GET /api/openapi.json` | 200, 138,946 bytes, 73 paths | the entire management + publisher API: bulk credential endpoints (`antigravity/bulk`, `codex/bulk`, `codebuddy/refresh-tokens`, `recheck-bulk`, `invalid`), quota artefacts (`usage-windows`, `auto-reset-credit`), `upstreams/{slug}/max-concurrent`, `schedule`, asks; "a single publisher can own six figures of credentials"; "Codex only; auto-spends real money" |
+| `GET /api/pricing/config` | `{"maxAskPctOfOfficial":0.5,"platformFeePct":0.2,"publisherSharePct":80}` | the cap, the fee, and the publisher share in one request |
+| `GET /api/market` | per-slug `family`, `minAskIn/Out`, `maxAskIn/Out`, `lastRate` | the 14 families; `cc/claude-opus-5-5` minAsk $0.796 vs maxAsk $2.00 (the cap) and `lastRate` 0 |
+| `GET /api/pricing/usage` | 24 h per-slug requests and token counts | measured volume: 5,684,357 requests, 406.5 bn input tokens, 9.62 bn output tokens, 152 slugs; the per-family split |
+| `GET /api/pricing/cache` | per-slug prompt-cache hit rate | 82.0% of all input tokens were cached in the window |
+| `GET /api/status` | availability, error causes, per-family latency | API availability 24 h 96.4%; causes no_capacity 62.7% / upstream_failed 37.2%; `claude-fable-5` 35.07% 24 h; per-family TTFT 5–19 s |
+| `GET /v1/models` (bogus bearer) | 403 `{"error":{"message":"access denied","type":"forbidden"}}` | key validation; OpenAI-compatible error shape |
+| `GET /robots.txt`, `/sitemap.xml`, `/openapi.json` | 404 | no robots/sitemap; the OpenAPI is served at `/api/openapi.json` |
+
+## Client-side artefact
+
+| Source | What it evidenced |
+|---|---|
+| `https://registry.npmjs.org/@inferhub%2Fhelper` | package `@inferhub/helper`, **maintainer `exzork`**, first published 2026-07-15, 13 versions to 0.2.9; repo `github.com/inferhub/helper` (not publicly resolvable); homepage `inferhub.dev` |
+| `@inferhub/helper` 0.2.9 tarball (`dist/constants.js`, `dist/usage-plugins.js`, `dist/adapters/*`, `README.md`) | which agent configs get rewritten (`~/.claude/settings.json` incl. `ANTHROPIC_DEFAULT_OPUS_MODEL`; `~/.codex/config.toml` + `auth.json`; OpenCode / OpenClaw / Hermes); usage-plugin packages `@inferhub/usage`, `@inferhub/opencode-usage` reporting to `GET /v1/me/usage`; base URL `https://api.inferhub.dev/v1` |
+| `https://api.github.com/users/exzork` | public profile linked to the npm maintainer handle; account created 2017, ~65 public repos, personal site `exzork.me` |
+
+## CodeBuddy (Tencent) — the farmed free tier
+
+| Source | What it evidenced |
+|---|---|
+| `https://www.codebuddy.ai/pricing` | Free $0 = 100 credits/month, daily active reward 30 credits/day, 250 welcome credits, 5,000 completions; Pro $7 first month then $10/mo = 2,000 credits |
+| `https://www.codebuddy.ai/docs/ide/Account/pricing` | Free 100 base credits, 30/day promotional bonus, "all models available during the promotional period", "Standard quotas resume when the promotion ends" |
+| `https://www.codebuddy.ai/docs/ide/Account/Subscription` | full daily-bonus rules; **"Activity Restrictions"** banning scripts/plug-ins/emulators/API calls/bulk registration and malicious multi-account control; FAQ banning "bulk registration, account sharing, account trading"; non-transferable credits |
+| `https://intl.cloud.tencent.com/document/product/1256/77269` | Free 100 credits/month; 250 new-user credits valid 14 days; Pro 7-day trial 500 credits; 30/50 credits-per-day bonus table |
+| `https://mvalentsev.github.io/awesome-free-ai-coding/providers/codebuddy/` (probe-verified 2026-10-05) | independent free-tier summary; the "does not resolve from US, India and Russia" finding (`www.codebuddy.ai` DNS answers `0.0.0.1` to client subnets there) |
+
+## The credential resale market
+
+| Source | What it evidenced |
+|---|---|
+| `https://mastumbas.id/product/codebuddy` | CodeBuddy account (access token + refresh token) at Rp 2,300 (~$0.14), 450 credits + auto +30/day, **3,303 sold**, wholesale to Rp 1,800 at ≥100; the seller's own description of what the token is for (9router, 28 models) and the full model-code list used for the slug comparison |
+| Same page, adjacent listings | Cline accounts Rp 2,000 (`cp/`), "Refresh Token Codebuddy CN 4000-5000 Credit" Rp 15,000 (`cbcn/`), "Apikey Codebuddy Global 30000 Credit" Rp 100,000, a CodeBuddy-CN listing attributed to `rdhx`, Gemini Pro links, and 1-day Webshare datacenter/residential proxy packs |
+
+## Upstream vendor terms
+
+| Source | What it evidenced |
+|---|---|
+| `https://code.claude.com/docs/en/legal-and-compliance` | **"Customers may not pay for, resell, or intermediate Claude usage on their end users' behalf"**; **"may not … route requests through Free, Pro, or Max plan credentials on behalf of their users"**; **"may not collect, store, or intermediate Claude.ai credentials or session tokens"** |
+| `https://www.anthropic.com/legal/consumer-terms`, `https://www.anthropic.com/legal/commercial-terms` | Consumer vs Commercial ToS split (Free/Pro/Max vs Team/Enterprise/API) — cited by the Claude Code compliance page |
+| `https://support.claude.com/en/articles/8241253-safeguards-warnings-and-appeals` | Anthropic enforcement surface: suspensions tied to Usage Policy, unsupported-location account creation, and ToS violations; appeal path |
+| Secondary reporting on enforcement | Jan 2026 + Apr 2026 changes blocking subscription OAuth tokens in third-party harnesses; ban reports and appeal outcomes (news/community posts). Treated as **secondary**, not vendor-primary |
+
+## Comparables and category context
+
+| Source | What it evidenced |
+|---|---|
+| `https://www.surplusintelligence.ai/` | same mechanic on different rails — "Open Market for Models", "your surplus capacity sold to the highest bidder", "list your API credits", Base-native, `SURPLUS` token |
+| `https://inferencehub.tech/` | same-niche competitor whose own copy labels the sector "**Gray-market supply · Start in minutes**" and states "We're not cheaper than the labs" |
+| `https://github.com/tashfeenahmed/freellmapi` | free-tier aggregation tier: 34 providers, 635 endpoints, claimed 7.4 bn tokens/month |
+| `https://devtoollab.com/blog/omniroute-free-ai-gateway` | peer gateway that **publishes a ToS table listing 15 providers whose terms prohibit proxy access**; also documents that "subscription pooling … violates seat-based licensing" |
+| `https://arxiv.org/abs/2607.20860` (IRIS) | black-box auditing of model substitution and routing dilution in LLM gateways — the substitute-backend threat model |
+| arXiv `2606.16100` | "Your 'Pro' LLM Subscription May Actually Be 'Free'": fingerprint spoofing risks in LLM inference services |
+| `https://github.com/benben951/llm-proxy-auditor` | a tool built for exactly this trust question (prompt integrity, model substitution, response rewriting) |
+
+## Prior internal research (workspace, not vaulted)
+
+| Path | What it evidenced |
+|---|---|
+| `RESEARCH/free-token-gateways/CONSOLIDATED_FINDINGS.md` + `EVIDENCE_OPERATOR_TRANSCRIPT.md` (2026-09-15) | the operator-run version of the same supply: pooled free-tier accounts behind one API, CodeBuddy free-token farming, bulk email + proxies + stealth browser, edu-mail marketplace in the operator's own community; LiteLLM falsified; four separate operations, no shared operator |
+| `RESEARCH/inferhub-marketplace/ORCHESTRATOR_INVESTIGATION.md` | orchestrator's full pass for this study, 12 sections, evidence-indexed |
+| `RESEARCH/inferhub-marketplace/SUPPLY_CHAIN_CODEBUDDY.md` | the CodeBuddy free-tier + resale-market chain with the slug-overlap comparison |
+| `RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/` | raw captures (pages, API JSON, DNS, npm metadata, unpacked helper package, `owner-proxy.png`) with URL + UTC timestamp provenance |