# ZTE MaaS Gateway

## Provider
ZTE Corporation internal MaaS (Model-as-a-Service) API gateway.

## Endpoint
```
https://maas-apigateway.dt.zte.com.cn/model/qwen3-coder-480b/v1
```

## Model
- `Qwen3-Coder-480B-A35B-Instruct` (MoE, 480B total / 35B active)

## Access
- **NO PUBLIC ENDPOINT EXISTS** (confirmed 2026-08-03 after deep enumeration).
- **IP-allowlisted at the firewall/SLB level.** TLS handshake succeeds from any
  IP, but every HTTP request is black-holed (0 bytes, timeout) from non-ZTE
  source IPs. This is network-layer ACL, not HTTP path routing — no
  header/path/hostname variant bypasses it.
- Evidence the key is internal-only:
  - `_remote.py` scripts explicitly `os.environ['NO_PROXY'] = '*'` and strip all
    proxy vars, meaning they are designed to run *inside* ZTE's network where the
    gateway is directly reachable.
  - `_local.py` uses OpenRouter through `http://proxyhk.zte.com.cn:80`, ZTE's HK
    egress proxy — that hostname is internal-DNS-only (NXDOMAIN externally).
- Alternate public-host enumeration (828 names across zte.com.cn / zx / dt /
  ztedev / xingyunsdk):
  - `maas-apigateway.zte.com.cn` / `.zx` / `.prod`, `maas.zte.com.cn` → NXDOMAIN
  - `api.zx.zte.com.cn` (47.106.172.209, Alibaba Cloud) — black-holes HTTP
  - `apigw.zte.com.cn` (202.103.147.189) — black-holes HTTP
  - `aistudio.zx.zte.com.cn` — 403 WAF / OpenResty default page (no API)
  - `chat.zx.zte.com.cn` — 502 Bad Gateway (backend down)
  - `aip.zte.com.cn` — ZTE public marketing site (nginx 404 + Aliyun WAF)
  - `openlab.zte.com.cn` — static SPA (all paths return index.html)
  - `maas-openapi.wanjiedata.com` — unrelated third-party MaaS, rejects key as
    `apiKey not found` (independent keyspace, not ZTE)
- The wildcard TLS cert is `*.dt.zte.com.cn` (DigiCert/GeoTrust, valid from Nov 2025).
- The key can only be used from inside a ZTE corporate network or VPN.

## Keys
| Key | Status | Source |
|-----|--------|--------|
| `2abd02c3-4e11-4a3b-88cf-341497e35892` | RESTRICTED_IP | zhzhwei/RealBench |

## Hunt summary
- GitHub code search: 24 queries, 622 candidate files
- Only **1** genuine MaaS API key found (the one provided by LO)
- Other UUID hits were NVD CVE database `matchCriteriaId` fields and social media
  share tokens — all noise
- The key was added in commit `85945904` ("run RealBench locally", 2025-09-21)
  and has never been rotated
- Only 1 public repo on GitHub references `maas-apigateway.dt.zte.com.cn`