A developer in Shenzhen cannot buy Claude, GPT or Gemini. None of the three American labs sells in China. Since last September, Anthropic will not even serve a Chinese-owned company anywhere on earth.
So he opens 云枢-API. Chinese interface, prices in yuan, Alipay accepted. The menu holds 101 models, OpenAI, Google, xAI and Anthropic side by side, from GPT and Gemini to Fable 5, the public version of a model Anthropic judged too powerful to release outright, and one Washington pulled from the market for three weeks this summer. Nobody asks his name.
Moscow has the same shop in Russian. LLMsRelay: $250 of Claude and OpenAI Codex credit for $23, by Russian bank card. Tehran has it in Persian. GPTYAR: a “dedicated Claude Pro account” for 6,388,872 toman (ten rials) a month, about $24, delivered in four hours.
Those are three shops out of hundreds VisionHeight found. China, Russia and Iran are the three places Anthropic, OpenAI and Google all leave off their lists of where they will operate, and the three Washington’s export-control fight is about. In all three, Claude, GPT and Gemini are on sale today.
None of the shops stole the models. They did something simpler, and this report explains it step by step: how a shop turns other people’s access into a product, what the shops look like in each country, how VisionHeight found them, and how one of them ended up supplying a fraud ring that Anthropic exposed in its September 2026 threat report.
How a grey-market shop works
A grey-market shop is a middleman. On one side it collects access to the models: API keys, subscriptions, other people’s cloud accounts. On the other side it sells you a key of its own. You send your requests to the shop; the shop forwards them to Claude or GPT using whichever access it has that is cheapest at that moment; the answer comes back to you.
The lab sees only the shop’s access. It never sees you. And since every rule the labs and Washington enforce, from country bans to export controls, works by knowing who holds the key, a buyer the lab cannot see is a buyer no rule can reach.
How do the shops get that access? Often, their own menus tell you. A shop sorts its supply into groups and gives each group a name, and the names describe the source. PomoAi, for example, has groups called claude-kiro, claude-cursor, claude-github-copilot and aws-bedrock: Claude obtained through a Kiro subscription, through Cursor, through Copilot, through an Amazon cloud account. Read enough of these labels across enough shops and three routes emerge. None of them is legitimate. One spends a stranger’s money, one is theft outright, one breaks a licence.
Someone else’s cloud account. Many companies reach Claude and GPT through Amazon, Microsoft and Google’s clouds, using their cloud account’s credentials. When those credentials leak, a shop uses them as its own supply, and every token it sells is charged to the victim company until someone there notices the bill. This is a stolen corporate credit card, used to buy stock for resale.
Stolen keys. API keys leak constantly: pasted into public code, left on misconfigured servers, copied by malware. Thieves gather them by the thousand, test which still work, and sell the live ones on. A shop that buys them is selling access that belongs to someone else, on that someone’s bill, under that someone’s name. It is the most reliable supply there is, because it is a real key on the lab’s own API, and it is the one the lab will eventually trace back to the wrong person.
A subscription shared with a crowd. Coding tools like Cursor, Amazon’s Kiro and GitHub Copilot license Claude from Anthropic and sell it as a flat monthly seat for one developer; Claude Code sells such a seat directly. A shop buys a seat, often with a stolen card or under a fake identity, and plugs it into the gateway, and now one person’s seat serves hundreds of strangers. That breaks the licence on every side: the tool’s terms, Anthropic’s terms, and the country bans both enforce. The seat costs the same however hard it is used, so every token the shop sells is almost pure profit. Anthropic sees Cursor’s traffic. Cursor sees one very busy subscriber. Think of one gym membership with five hundred people sharing the card, and the gym billing the one name on it.
The prices follow the source. Across the shops that priced it, Claude Opus sells at a median 40% below Anthropic’s list price and as low as 70% below. The only business risk is losing a seat or a key when the lab notices, so shops keep “account pools” of spares to swap in.
The menus even carry the newest and most restricted models within weeks of release: Fable 5 on 云枢-API, Opus 5.5 on PomoAi, each with a discount tier of its own. A market that advertises the model Washington pulled this summer, in a country where its maker sells nothing, is not selling a product. It is selling a way around the gate.
The shops
China. Most of the market lives here. Seven in ten branded shops run on Chinese cloud, in the mainland and Hong Kong. Chinese interfaces. Yuan prices. Alipay and WeChat Pay. Group labels like “official key,” “Amazon cloud” and “discount Claude,” written for a buyer who knows the front door is shut and is picking a back one. 云枢-API, one shop among hundreds on the mainland, lists Claude Opus 4.6 through 5.5, Sonnet 4.6 and 5, and claude-fable-5 at $9 in and $45 out, next to GPT, Gemini and Grok, each tagged with where it comes from.
PomoAi, Chinese-language and hosted in Hong Kong, is the showroom. 323 models. A public price table that lists Claude Opus 5 at Anthropic’s $5 per million tokens, then the same model through Amazon Kiro subscriptions at 30% and 40% of that, through GitHub Copilot at 80%, and through Claude Code Max seats at a premium for buyers who want it “stable.” Its channel notes explain the sourcing in plain Chinese: “claude 来源于 cursor.” Claude, sourced from Cursor.
Russia. Fewer shops, lower prices. LLMsRelay sells “AI platform credit packages” for Claude and OpenAI’s Codex in four sizes, $250 to $5,000 of balance. The $250 package costs $23. Nine cents on the dollar, by Russian bank card, SBP or crypto. The small print says the shop is not affiliated with Anthropic. On that, it is accurate.
Iran. Here the product changes shape. GPTYAR, Persian-language and promoted through Iranian tech media, sells a “dedicated Claude Pro account”: 6,388,872 toman a month, about $24, paid in rials, delivered within four hours, renewable. Not API tokens but a consumer subscription, opened on the buyer’s behalf with a foreign card and handed over. No discount here. Claude Pro lists at about $20. The Iranian buyer pays a premium for access the maker refuses to sell.
How VisionHeight found the shops
Every server on the internet gives itself away a little. When you connect to it, it answers with small tells: the name of the software it runs, a version number, a page title. VisionHeight collects those tells from every reachable server on the internet, continuously, and keeps the history. That is fingerprinting, and it is one of the company’s core instruments.
The gateway software the shops run has a tell of its own. So the search went in three steps. First, find every server with that tell: about 35,000. Second, separate the hobby installs from the businesses: a private install keeps the software’s default name, a shop puts its brand on the door, and about 2,900 had. Third, read what each shop publishes to anyone who asks: its model menu and its price list, including the labelled supply groups. Everything in this report about what the shops sell and where they get it comes from pages the shops show the public.
Because the fingerprinting never stops, the picture is not a snapshot. When a shop moves to a new server, changes its name, or a new one opens, the change itself shows up. That is how VisionHeight keeps finding the shops after the ones in this report are gone.
How VisionHeight saw the key thieves
Finding the shops shows where stolen keys end up. Seeing where they come from takes a different instrument, and VisionHeight already runs it.
A honeypot is a fake server built to be attacked. VisionHeight keeps hundreds of them running worldwide, all the time, dressed as the kind of system a careless developer leaves running: an AI model server here, an API gateway there, with secrets left in plain view. The secrets are bait. Anyone who finds them and tries to use them is up to no good, and the honeypot records everything they do.
The AI-shaped decoys are never quiet. In one two-week sample, more than 1,200 addresses in dozens of countries came knocking, around the clock, at machine speed. None were curious humans. Four kinds of visitor stood out, and the one closest to the shops spoke Chinese.
The shopkeepers. Before stock goes on a menu, it gets tested. Some visitors send the decoy a few short prompts in Anthropic’s own API format, and the prompts are in Chinese: who are you, which model are you, are you the model you claim to be. Nothing is stolen here; the channel is being inspected. That is the signature of a reseller checking stock before it goes on a Chinese-language menu, making sure the Claude it is about to sell in Shenzhen is Claude. It is the market in this report seen from the back of the store, the one place where the supply chain introduces itself in the buyer’s language.
The sorters. Machines arrive with lists of API keys and try every one, keeping those that still work. In one four-hour window, three addresses inside Microsoft’s Azure cloud tested 18,504 keys against a single decoy. Nobody holds 18,504 keys by accident. This is a stolen list being sorted into live and dead, the way a card thief tests a stack of stolen cards to see which still swipe.
The hunters. Scanners sweep the internet for any server that answers like an AI model, so it can be catalogued and resold. One pretends to be Anthropic’s own Claude Code tool and asks every address the same question, “What is 2+3?”, listening for a model to reply.
The diggers. Others go straight for where secrets are kept on a badly configured server: settings files, setup pages, open management ports. This is how new keys are found. It never stops.
Stolen, sorted, tested, listed. By the time a key reaches a storefront in Shenzhen, Moscow or Tehran, every step has already happened in the open.
The shop in Anthropic’s report
In September Anthropic published a threat report on an operation it calls GTG-15001: a Chinese fraud ring running fake dating apps staffed by AI personas, which Anthropic says reached 25,000 real people. The report named one internet address as the operation’s “egress proxy”: the server the scammers’ requests passed through on their way to Anthropic.
VisionHeight looked at the address. It is not a private proxy. It is a shop, and has been for a long time.
The server runs the same gateway software as every storefront in this report. Registration open. No email verification. Stripe top-ups. Prices in yuan. The menu lists Anthropic and OpenAI models, video included, with Claude behind a membership tier labelled “Claude Code enterprise.” It came online around December 2025 and has not gone dark since. On 7 October, six storefront domains under four brands pointed at it. The server is in the United States. The prices are in yuan. That is the market’s geography in one box: Chinese buyers, Chinese-language shops, servers wherever is convenient.
So the operation Anthropic exposed did not build its own pipe to Claude and did not steal a key. A Chinese operator, barred from Anthropic by policy and by law, walked into a shop that serves Chinese buyers in yuan, paid, and got a working key. Whoever else was buying that week shared the pipe. From Anthropic’s side they all looked like one account.
That is the connection, and it runs one way. Anthropic saw a proxy. VisionHeight sees the store, the market behind the store, and the harvest behind the market.
Why it matters
Export controls work on crates. Chips can be counted at a port. A model crosses a border as an API request, and the only thing in its way is the provider knowing who sent it. Every rule Washington and the labs have written, export lists, usage policies, safety reviews, is enforced at that one moment. The grey market’s whole business is making sure nobody knows who is asking.
That is why a market of hundreds of shops, in the three countries where every rule applies, matters more than its size. Each shop sells the controlled thing over the counter, in local currency, to anyone. The gap between what the rules say and what the shops deliver is wide enough to drive a 25,000-victim fraud ring through.
The bill lands everywhere. The labs sell metered usage at subscription prices and punish the wrong party. Amazon, Cursor and GitHub pay for a crowd on a seat priced for one. A company whose cloud keys land on a Chinese menu pays for strangers’ traffic until someone notices. And every buyer sends prompts, code and customer data through an anonymous middleman whose only promise is that “Claude” is Claude.
None of them can see it. The labs look at an account and see one customer. The vendors see one subscriber. The cloud customer sees a bill. The shop is one of tens of thousands of identical installs on the open internet, and the key thieves only show themselves to a server worth robbing.
VisionHeight can see it, and keeps seeing it. It fingerprints every server on the internet, continuously, and keeps the history, so when a gateway appears on a fresh address, a storefront moves hosts, a brand changes its name or a key list grows overnight, the change itself is the signal. The shops in this report were found that way. The ones that replace them will be found the same way, because the market moves and VisionHeight watches it move. Each supply route leaves a mark: a key where it should not be, one subscription serving a thousand users, a cloud account behaving like a shop. Seen while it is being built, infrastructure can be cut off before the first victim, not written up after the last.
Washington spent the year deciding which models may leave the country. In Beijing, Moscow and Tehran they had already arrived: by the token, in local currency, with a referral bonus.