I think I was part of a model distillation attack
sebastianmarines.comsounds more like a pirated api key sold to someone in china and the first one is the buyer and the rest are either a single entity or some pirated open router service.
I do not think distallation works like this; could be wrong though.
Or both, if you're distilling a model (which is already against ToS), why not go for gray/black market leaked API keys instead of paying full price.
Or for the pirate open router service people, part of the "distillation" is just logging all conversations and selling that as training data to labs with less scruples.
I think you mean the distilling is a secondary activity by another party.
Primary seems it's just a stolen api key and there's likely a broker running some kind of pirated router. Which makes the most sense with random unconnected testing.