Forensic Audit — 7 Models, 224 Probes

Each of the 7 models on capi.aerolink.lat received an identical 32-prompt battery (3 suites: identity, capability, fingerprint). Click a model to expand full probe Q&A.

Per-Model Report (click to expand)

Each card shows self-identification, knowledge cutoff match, latency, errors, Claude Code leak count, and the full 32 probe Q&A responses across all 3 suites.

Provider Comparison — 25+ Relay Stations

Pricing, stability, and channel purity compared across every publicly-visible Claude relay provider. Cross-referenced with Veridrop's 1,118-station leaderboard, Help AIO's 24/7 uptime monitoring, and community recommendations from Linux.do, V2EX, and SegmentFault.

🏆 Top 5 — cheapest AND stable (verified)

Balancing: (a) independent 3rd-party verification (Veridrop sig rate + Help AIO uptime), (b) real price economics including cache, (c) forum reputation longevity, (d) channel purity. Services with only 1 Veridrop test or no independent monitoring are excluded from "stable" even if cheap.

Full comparison table

Providers to avoid (evidence-based)

Curated reference lists

Supply Chain Deep Dive — Who & How

The cheap Claude access doesn't come from nowhere. Here's the full supply chain, the economics, the named operators, and the technical mechanism — sourced from Chinese industry exposés, GitHub projects, and community forums.

The 4-tier source model

The technical mechanism — mitmproxy CLI injection

Projects like WoulderX/claude-subscription-proxy and zhangbinhui/claude-max-proxy document it openly. This is exactly why we saw Claude Code text leaking in every probe — it's not a bug, it's the required disguise.

The wholesale pyramid

Per the aitntnews exposé: "能追溯到源头的就七八家大号池" (only 7-8 traceable big account pools). Same article: a ¥198/mo carpool seat costs ¥89 at source — the ¥109 difference is split across 3-4 middlemen.

Named operators (publicly visible)

Naming individual underground account farmers would be irresponsible — they operate via 闲鱼 DMs, WeChat handles, and Telegram groups, identities easily faked. The publicly-branded services below are fair game because they've chosen to be public.

Tier A — Vertically integrated (account-farm + public relay)

Tier B — The "Big 7-8 pools" (mentioned but not fully named)

Tier C — Sub2API sponsors (publicly visible middlemen)

From the Sub2API README sponsor table — publicly-operated middlemen running on the Sub2API stack. Not necessarily sources, but the visible part of the pyramid.

How Aerolink fits in

Additional context — enforcement & risks

Open-source tools in the ecosystem

Infrastructure Fingerprint — Reverse-Engineering the Gateway

How the gateway was identified as NewAPI via three source-code-level fingerprints, plus the hosting layer, mesh proxy, and the full chain from client to Anthropic.

Three fingerprints that proved NewAPI

All three match NewAPI's source code exactly. Confirmed by independent third-party integrations (CherryHQ/cherry-studio, lobehub/lobe-chat, can1357/oh-my-pi).

oaiModel.SupportedEndpointTypes = model.GetModelSupportEndpointTypes(modelName)

openAIModels = append(openAIModels, dto.OpenAIModels{
    Id: modelName,
    Object: "model",
    Created: 1626777600,   // hardcoded for every model
    OwnedBy: channelName,
})

The hosting layer

capi.aerolink.lat
  → CNAME: kmoxknduoxjs.cloud.sealos.io
    → A: 35.197.149.75  (AS396982 Google LLC, Singapore)
    → A: 34.87.110.152  (AS396982 Google LLC, Singapore)
    → A: 34.143.149.171 (AS396982 Google LLC, Singapore)
    [+ 5 more GCP Singapore IPs]

server: istio-envoy
req-cost-time: 1235
req-arrive-time: 1783844040872
resp-start-time: 1783844042108
x-envoy-upstream-service-time: 1235

The operator vs. the software

The full proxy chain

Claude Code injection — the smoking gun

Veridrop history — the instability pattern

Methodology, Verification & Sources

How this audit was conducted, the tools used, how to reproduce it, and every source cited — with links that open in new tabs.

Tools used

How to reproduce this audit

# 1. Clone llm-verify
git clone https://github.com/mintesnot-teshome/llm-verify.git
cd llm-verify

# 2. Set up environment
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

# 3. Configure .env with the suspect API
cp .env.example .env
# Edit .env:
#   SUSPECT_API_KEY=your-suspect-key
#   SUSPECT_API_BASE_URL=https://capi.aerolink.lat

# 4. Run the API server
uvicorn src.main:app --port 8000

# 5. Run deep analysis against all models (32 probes each)
curl -X POST http://localhost:8000/api/v1/analysis/deep \
  -H "Content-Type: application/json" \
  -d '{"name":"Audit","model_configs":[
    {"model_name":"claude-opus-4-8","provider":"suspect","protocol":"anthropic"},
    {"model_name":"claude-fable-5","provider":"suspect","protocol":"anthropic"},
    ...
  ],"suites":["identity","capability","fingerprint"]}'

# 6. Inspect raw probe responses
curl http://localhost:8000/api/v1/results/{run_id}

The 6-step verification checklist (for any provider)

All sources & references

Open-source tools & code

• mintesnot-teshome/llm-verify
  https://github.com/mintesnot-teshome/llm-verify
  The audit tool used in this report. Behavioral fingerprinting with 32 forensic prompts across identity, capability, and fingerprint suites. MIT license.
  audit tool
• QuantumNous/new-api
  https://github.com/QuantumNous/new-api
  The gateway software identified on capi.aerolink.lat. 39K★, AGPL-3.0, Chinese. Fork of one-api. The supported_endpoint_types field and hardcoded 1626777600 timestamp are the fingerprints that proved it.
  gateway software
• songquanpeng/one-api
  https://github.com/songquanpeng/one-api
  The original Chinese LLM gateway. NewAPI's parent. 35K★.
  gateway software
• Wei-Shaw/sub2api
  https://github.com/Wei-Shaw/sub2api
  Subscription-to-API gateway. 25K★. The "拼车" reference deployment. PinCC is its official hosted service. README lists all sponsor relay operators.
  carpool infra
• Wei-Shaw/claude-relay-service
  https://github.com/Wei-Shaw/claude-relay-service
  Self-hosted Claude Code mirror with account-pool management. 12K★. Same author as Sub2API.
  carpool infra
• WoulderX/claude-subscription-proxy
  https://github.com/WoulderX/claude-subscription-proxy
  Documents the mitmproxy CLI injection mechanism used for Tier 1 reselling. Explains the 10+ Anthropic fingerprint signals and why real CLI subprocesses are required.
  mechanism
• zhangbinhui/claude-max-proxy
  https://github.com/zhangbinhui/claude-max-proxy
  Another Max-subscription-to-API proxy with tool-name mapping and CCH signature calculation. Documents system-prompt migration to bypass Anthropic's third-party detection.
  mechanism
• canarybyte/veridrop
  https://github.com/canarybyte/veridrop
  The open-source relay-station detector. Cryptographic thinking-signature verification. 154★, AGPL-3.0. Hosted at veridrop.org.
  verification
• zxc123aa/cc-proxy-detector
  https://github.com/zxc123aa/cc-proxy-detector
  Fingerprinting reference: tool_use id prefixes (toolu_ vs tooluse_), msg_id formats, thinking signatures by source (Anthropic/Bedrock/Vertex).
  verification
• labring/sealos
  https://github.com/labring/sealos
  The AI-native Kubernetes PaaS that hosts Aerolink's gateway (capi.aerolink.lat CNAMEs to *.cloud.sealos.io).
  hosting
• howardpen9/awesome-ai-api-proxy
  https://github.com/howardpen9/awesome-ai-api-proxy
  Maintainer-verified catalog of Chinese/Asian relay stations with status canaries. The most reliable public list. Data in data/providers.yaml.
  catalog
• l1i1/ai-router-reviews
  https://github.com/l1i1/ai-router-reviews
  Independent reviews of API router platforms (Tokeness, PackyCode, 302.AI, OpenRouter) with price/latency comparisons.
  reviews
• mn-api/awesome-ai-proxy (unmaintained)
  https://github.com/mn-api/awesome-ai-proxy
  The original community list (~31 stations). No longer maintained as of 2026. Superseded by howardpen9/awesome-ai-api-proxy.
  catalog (stale)

Industry investigations & articles

• "我花了半个月，把AI中转站这门生意从头到尾扒透" (aitntnews)
  https://www.aitntnews.com/newDetail.html?newId=24713
  2-week embedded exposé of the relay-station industry. Source of the "7-8 big pools" figure, the ¥50-150 account costs, and the 70% overselling margin. Key quote: "能追溯到源头的就七八家大号池".
• "Claude 中转站全解析" (makerjackie)
  https://makerjackie.com/blog/2026-05-06-claude-api-proxy-deep-dive
  Industry structure analysis. Names PackyCode as a former upstream source. Details the 源头号商 → 经销商 → 耗商 pyramid.
• "Inside China's grey market for banned US AI models" (Medianama)
  https://www.medianama.com/2026/07/223-china-transfer-station-economy-explained/
  English-language investigation. Source of the "one fish, three meals" economic model and the log-harvesting-for-distillation angle. Links to HuggingFace Claude reasoning datasets.
• "倒卖token变成一门生意" (新浪财经/Sina Finance)
  https://finance.sina.com.cn/stock/t/2026-05-19/doc-inhykxft7581219.shtml
  Mainstream Chinese finance media coverage. Confirms the 闲鱼 ¥9.9 拼车 tier and IDE-reverse as the "most common source". Quotes a 3-station operator clearing thousands/day.
• "China's Cheap Claude Tokens" (winbuzzer)
  https://winbuzzer.com/2026/07/03/chinas-cheap-claude-tokens-run-through-proxy-markets-xcxwbn/
  Reports Anthropic's finding that proxy networks ran distillation campaigns with 20,000+ fraudulent accounts and 16M+ Claude exchanges.
• "AI Relay Stations: Hidden Pitfalls" (HTX Insights)
  https://www.htx.com/en-us/news/413734/
  Risk analysis. "Users may unknowingly surrender prompts, code, business documents, customer data, and even full project contexts."
• "《科普下中转号里的行业内幕》" (dashenk)
  https://dashenk.com/2026/04/24/
  Industry insider breakdown. Pure-blood accounts at $1.35 each at source. KYC farms at ¥80. The Shandong AWS partner with "unlimited account issuance".
• Claude Code gateway protocol reference (Anthropic)
  https://code.claude.com/docs/en/llm-gateway-protocol
  Official Anthropic docs on how Claude Code routes through gateways. Documents the headers (x-claude-code-session-id, anthropic-beta, etc.) that relay stations must preserve.

Community threads (recommendations & warnings)

• V2EX: "claude code 使用哪家国内 api 靠谱" (2026-03)
  https://www.v2ex.com/t/1196478
  100+ replies recommending bytecat, terminal.pub, ofox.ai, aihezu, holysheep.ai, cubence, etc. Key insight: "就没有一直稳定的...我同时用了5家" (no one is always stable, I use 5 simultaneously).
• V2EX: "卡商+号商自建的 Claude API 中转站" (2026-03)
  https://www.v2ex.com/t/1198574
  AiYa operator's public post admitting to being 卡商+号商. Source of "封了就补，不会断供" and "缺卡的找我" quotes.
• Linux.do: "省钱系列8 — Claude Code Max 所有渠道研究" (2026-03)
  https://linux.do/t/topic/1740014/2
  Comprehensive channel research. Price tables for Max拼车, Cursor, Antigravity, Kiro, AWS reverse. Source of the "综合能力: Max~=bedrock>AG>cursor>>kiro" ranking.
• SegmentFault: "我对比了8个Claude API中转站" (2026-04)
  https://segmentfault.com/a/1190000047718715
  Independent 8-station comparison with weighted pricing. Ranks 灵眸AI, 神马中转, PackyAPI, poloapi, laozhang.ai, apiyi, AIHubMix, OpenRouter.
• V2EX: "中转站为什么这么费钱？明明便宜70%" (2026-03)
  https://www.v2ex.com/t/1201851
  Explains why sticker-price 70% discounts often cost MORE than official due to missing prompt caching, hidden system prompts, and pool-rotation cache invalidation.
• Help AIO — 24/7 relay station monitoring
  https://www.helpaio.com/
  Independent uptime monitoring across 15+ stations. Real-time Opus/GPT-5 availability, bench tests, price comparison. "无赞助广告" (no sponsored ads).

Anthropic official

• Anthropic — Claude Fable 5 and Claude Mythos 5 launch
  https://www.anthropic.com/news/claude-fable-5-mythos-5
  June 9, 2026 launch announcement. Fable 5 is a Mythos-class model with safety safeguards that fall back to Opus 4.8. $10/$50 per MTok. Confirms Fable 5 is real.
• Anthropic — Models overview
  https://platform.claude.com/docs/en/about-claude/models/overview
  Official model IDs, knowledge cutoffs, context windows, pricing. Used to verify all 7 models on aerolink are genuine Anthropic IDs with correct cutoffs.

Reproducibility