cf8619cc5fInferHub case study: subscription-entitlement resale, free-tier account farming, proxy-pooled credential fleets, and the cheapest-wins auction that prices them. Four files: index, analysis, sources, next-steps. Evidence is public and unauthenticated only: InferHub terms/privacy/docs and its public API (/api/openapi.json, /api/pricing/config, /api/market, /api/pricing/usage, /api/status), the npm @inferhub/helper package, CodeBuddy's own pricing/subscription docs, mastumbas.id, and code.claude.com/docs/en/legal-and-compliance.
101 lines
11 KiB
Markdown
101 lines
11 KiB
Markdown
---
|
||
title: Sources — LLM Subscription-Resale Markets
|
||
description: Reference list for the subscription-resale inference market study, with what each source evidenced.
|
||
status: active
|
||
category: market
|
||
tags: [inference-market, sources]
|
||
draft: true
|
||
created: 2026-10-05
|
||
updated: 2026-10-05
|
||
---
|
||
|
||
# Sources — LLM Subscription-Resale Markets
|
||
|
||
> Part of [[llm-subscription-resale-markets/index|LLM Subscription-Resale Markets]]
|
||
|
||
All accessed 2026-10-05, unauthenticated. Web pages fetched between 19:37 and 20:05 UTC; raw
|
||
captures with URL + UTC timestamp provenance are kept in the workspace at
|
||
`RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/`.
|
||
|
||
## InferHub — first-party pages (the target of the study)
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://inferhub.dev/terms` (last updated 2026-10-02) | §2 self-description as a *subscription-reselling reverse proxy and marketplace*; §5 acceptable use; §6 paid-vs-free resale rules; §7 publisher warranties + indemnity; §8 non-refundable balances and chargeback forfeiture; §10 no output-rights warranty |
|
||
| `https://inferhub.dev/privacy` (last updated 2026-06-17) | credential storage model (`api_key_enc`, `oauth_refresh_enc`, AES-256-GCM, in-process decrypt); 7-day retention of system prompt + tool definitions on security-policy rejection; 14-day retention of screened message text; the "keep content … off the provider accounts that serve you" screening rationale; sub-processors (PostgreSQL, Redis, NATS, Solana RPC, Cloudflare); data controller = the individual operator, jurisdiction undisclosed |
|
||
| `https://inferhub.dev/` | publisher pitch; "Real upstream quota tracking … live 5-hour and weekly usage windows"; "Per-provider outbound proxy pool routes your traffic through least-used egress"; live market ticker with per-slug asks (e.g. `cc/claude-opus-5-5 ask $0.8`); "Models reachable without buying the plan" table |
|
||
| `https://inferhub.dev/pricing` | full model table with official reference prices and per-tier asks/avail; the 50%-of-official cap statement; platform headline counts (14 upstreams / 155 model IDs / 74,310 active providers); minimum charge $0.00001; cache-badge definition |
|
||
| `https://inferhub.dev/faq` | "pools upstream LLM subscriptions … behind a single OpenAI- and Anthropic-compatible API"; bcrypt/argon2id/AES-256-GCM claims; publisher obligations |
|
||
| `https://inferhub.dev/docs` | routing tips: auto-routing with up to 5 hops; `429 capacity_saturated`; `402 no_provider_under_bid`; `503 no_capacity` on monthly caps; `x-ignore-upstream` (reveals the unlisted `qd` prefix); the `systemPromptNote` / "Cursor prepends its own agent prompt" statement; `free/<provider>/<model>` naming |
|
||
| `https://inferhub.dev/docs/api` | three surfaces on one `sk-airo-` key: inference (`api.inferhub.dev`), management REST API, MCP SSE at `/mcp/sse`; `combo/<slug>` routing |
|
||
| `https://inferhub.dev/docs/api/reference` | rate limits (30 rpm management / 500 rpm inference per account); model-name formats; minimum-charge worked example; `account_blocked` semantics |
|
||
| `https://inferhub.dev/status` | status page shell (JSON is at `/api/status`) |
|
||
| `https://inferhub.dev/refund-policy` | non-refundable balance policy |
|
||
|
||
## InferHub — public API surface (no auth required)
|
||
|
||
| Endpoint | Response | What it evidenced |
|
||
|---|---|---|
|
||
| `GET /api/openapi.json` | 200, 138,946 bytes, 73 paths | the entire management + publisher API: bulk credential endpoints (`antigravity/bulk`, `codex/bulk`, `codebuddy/refresh-tokens`, `recheck-bulk`, `invalid`), quota artefacts (`usage-windows`, `auto-reset-credit`), `upstreams/{slug}/max-concurrent`, `schedule`, asks; "a single publisher can own six figures of credentials"; "Codex only; auto-spends real money" |
|
||
| `GET /api/pricing/config` | `{"maxAskPctOfOfficial":0.5,"platformFeePct":0.2,"publisherSharePct":80}` | the cap, the fee, and the publisher share in one request |
|
||
| `GET /api/market` | per-slug `family`, `minAskIn/Out`, `maxAskIn/Out`, `lastRate` | the 14 families; `cc/claude-opus-5-5` minAsk $0.796 vs maxAsk $2.00 (the cap) and `lastRate` 0 |
|
||
| `GET /api/pricing/usage` | 24 h per-slug requests and token counts | measured volume: 5,684,357 requests, 406.5 bn input tokens, 9.62 bn output tokens, 152 slugs; the per-family split |
|
||
| `GET /api/pricing/cache` | per-slug prompt-cache hit rate | 82.0% of all input tokens were cached in the window |
|
||
| `GET /api/status` | availability, error causes, per-family latency | API availability 24 h 96.4%; causes no_capacity 62.7% / upstream_failed 37.2%; `claude-fable-5` 35.07% 24 h; per-family TTFT 5–19 s |
|
||
| `GET /v1/models` (bogus bearer) | 403 `{"error":{"message":"access denied","type":"forbidden"}}` | key validation; OpenAI-compatible error shape |
|
||
| `GET /robots.txt`, `/sitemap.xml`, `/openapi.json` | 404 | no robots/sitemap; the OpenAPI is served at `/api/openapi.json` |
|
||
|
||
## Client-side artefact
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://registry.npmjs.org/@inferhub%2Fhelper` | package `@inferhub/helper`, **maintainer `exzork`**, first published 2026-07-15, 13 versions to 0.2.9; repo `github.com/inferhub/helper` (not publicly resolvable); homepage `inferhub.dev` |
|
||
| `@inferhub/helper` 0.2.9 tarball (`dist/constants.js`, `dist/usage-plugins.js`, `dist/adapters/*`, `README.md`) | which agent configs get rewritten (`~/.claude/settings.json` incl. `ANTHROPIC_DEFAULT_OPUS_MODEL`; `~/.codex/config.toml` + `auth.json`; OpenCode / OpenClaw / Hermes); usage-plugin packages `@inferhub/usage`, `@inferhub/opencode-usage` reporting to `GET /v1/me/usage`; base URL `https://api.inferhub.dev/v1` |
|
||
| `https://api.github.com/users/exzork` | public profile linked to the npm maintainer handle; account created 2017, ~65 public repos, personal site `exzork.me` |
|
||
|
||
## CodeBuddy (Tencent) — the farmed free tier
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://www.codebuddy.ai/pricing` | Free $0 = 100 credits/month, daily active reward 30 credits/day, 250 welcome credits, 5,000 completions; Pro $7 first month then $10/mo = 2,000 credits |
|
||
| `https://www.codebuddy.ai/docs/ide/Account/pricing` | Free 100 base credits, 30/day promotional bonus, "all models available during the promotional period", "Standard quotas resume when the promotion ends" |
|
||
| `https://www.codebuddy.ai/docs/ide/Account/Subscription` | full daily-bonus rules; **"Activity Restrictions"** banning scripts/plug-ins/emulators/API calls/bulk registration and malicious multi-account control; FAQ banning "bulk registration, account sharing, account trading"; non-transferable credits |
|
||
| `https://intl.cloud.tencent.com/document/product/1256/77269` | Free 100 credits/month; 250 new-user credits valid 14 days; Pro 7-day trial 500 credits; 30/50 credits-per-day bonus table |
|
||
| `https://mvalentsev.github.io/awesome-free-ai-coding/providers/codebuddy/` (probe-verified 2026-10-05) | independent free-tier summary; the "does not resolve from US, India and Russia" finding (`www.codebuddy.ai` DNS answers `0.0.0.1` to client subnets there) |
|
||
|
||
## The credential resale market
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://mastumbas.id/product/codebuddy` | CodeBuddy account (access token + refresh token) at Rp 2,300 (~$0.14), 450 credits + auto +30/day, **3,303 sold**, wholesale to Rp 1,800 at ≥100; the seller's own description of what the token is for (9router, 28 models) and the full model-code list used for the slug comparison |
|
||
| Same page, adjacent listings | Cline accounts Rp 2,000 (`cp/`), "Refresh Token Codebuddy CN 4000-5000 Credit" Rp 15,000 (`cbcn/`), "Apikey Codebuddy Global 30000 Credit" Rp 100,000, a CodeBuddy-CN listing attributed to `rdhx`, Gemini Pro links, and 1-day Webshare datacenter/residential proxy packs |
|
||
|
||
## Upstream vendor terms
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://code.claude.com/docs/en/legal-and-compliance` | **"Customers may not pay for, resell, or intermediate Claude usage on their end users' behalf"**; **"may not … route requests through Free, Pro, or Max plan credentials on behalf of their users"**; **"may not collect, store, or intermediate Claude.ai credentials or session tokens"** |
|
||
| `https://www.anthropic.com/legal/consumer-terms`, `https://www.anthropic.com/legal/commercial-terms` | Consumer vs Commercial ToS split (Free/Pro/Max vs Team/Enterprise/API) — cited by the Claude Code compliance page |
|
||
| `https://support.claude.com/en/articles/8241253-safeguards-warnings-and-appeals` | Anthropic enforcement surface: suspensions tied to Usage Policy, unsupported-location account creation, and ToS violations; appeal path |
|
||
| Secondary reporting on enforcement | Jan 2026 + Apr 2026 changes blocking subscription OAuth tokens in third-party harnesses; ban reports and appeal outcomes (news/community posts). Treated as **secondary**, not vendor-primary |
|
||
|
||
## Comparables and category context
|
||
|
||
| Source | What it evidenced |
|
||
|---|---|
|
||
| `https://www.surplusintelligence.ai/` | same mechanic on different rails — "Open Market for Models", "your surplus capacity sold to the highest bidder", "list your API credits", Base-native, `SURPLUS` token |
|
||
| `https://inferencehub.tech/` | same-niche competitor whose own copy labels the sector "**Gray-market supply · Start in minutes**" and states "We're not cheaper than the labs" |
|
||
| `https://github.com/tashfeenahmed/freellmapi` | free-tier aggregation tier: 34 providers, 635 endpoints, claimed 7.4 bn tokens/month |
|
||
| `https://devtoollab.com/blog/omniroute-free-ai-gateway` | peer gateway that **publishes a ToS table listing 15 providers whose terms prohibit proxy access**; also documents that "subscription pooling … violates seat-based licensing" |
|
||
| `https://arxiv.org/abs/2607.20860` (IRIS) | black-box auditing of model substitution and routing dilution in LLM gateways — the substitute-backend threat model |
|
||
| arXiv `2606.16100` | "Your 'Pro' LLM Subscription May Actually Be 'Free'": fingerprint spoofing risks in LLM inference services |
|
||
| `https://github.com/benben951/llm-proxy-auditor` | a tool built for exactly this trust question (prompt integrity, model substitution, response rewriting) |
|
||
|
||
## Prior internal research (workspace, not vaulted)
|
||
|
||
| Path | What it evidenced |
|
||
|---|---|
|
||
| `RESEARCH/free-token-gateways/CONSOLIDATED_FINDINGS.md` + `EVIDENCE_OPERATOR_TRANSCRIPT.md` (2026-09-15) | the operator-run version of the same supply: pooled free-tier accounts behind one API, CodeBuddy free-token farming, bulk email + proxies + stealth browser, edu-mail marketplace in the operator's own community; LiteLLM falsified; four separate operations, no shared operator |
|
||
| `RESEARCH/inferhub-marketplace/ORCHESTRATOR_INVESTIGATION.md` | orchestrator's full pass for this study, 12 sections, evidence-indexed |
|
||
| `RESEARCH/inferhub-marketplace/SUPPLY_CHAIN_CODEBUDDY.md` | the CodeBuddy free-tier + resale-market chain with the slug-overlap comparison |
|
||
| `RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/` | raw captures (pages, API JSON, DNS, npm metadata, unpacked helper package, `owner-proxy.png`) with URL + UTC timestamp provenance |
|