Resold API keys, off the market.
Farmed accounts come with API keys, and keys sell. Esuba finds where access to your service is pooled, advertised and sold, reports the sellers and the infrastructure behind them, and helps you tell farmed keys from real ones.
From farmed accounts to a key shop
Once a farm can create accounts faster than you can ban them, every account is a key with your free credit on it. Operators pool those keys and sell access, often through Telegram channels and bots, so your compute ends up serving someone else's customers.
The Case 001 operator claimed a bank of 703+ keys. That's the operator's number and we couldn't verify it; only the client's own ledger can. What we could verify was the toolkit producing the accounts and the channel promoting it.
What Esuba does
- Finds the channels, bots and posts selling access to your service
- Reports each one to the platform and host behind it, from your domain
- Traces the sellers back to the toolkit and the operator, so successors get caught too
- Flags any key that looks like yours in a public repo or post, so you can revoke it
- Recommends spending caps for fresh keys and holding credit until the first real API call
Revoking without hurting real users
Revoking keys in bulk can hit genuine customers. With your grant data, we match accounts to the operator's patterns: the same parent domains, the same OAuth route, the same burst of signups. You revoke the farmed keys and leave real ones alone.
Esuba recommends; your team decides and makes the change.
Questions
Will reporting a key shop take it down?
Sometimes quickly, sometimes not. In Case 001 GitHub removed the first account in two days, while the Telegram channel was still live with no reply 12 days after our report. We keep following up, and your weekly report shows what's still up.
Do you test the keys?
No. We never use leaked credentials or run the operator's tools. Public reads only.