[
  {
    "key": "2abd02c3-4e11-4a3b-88cf-341497e35892",
    "source": "https://github.com/zhzhwei/RealBench/blob/859459047d27de18e569ba0ea53f37dc84676d17/auto_inference_remote.py",
    "detail": "ZTE MaaS corporate gateway. Leaked in commit 85945904 'run RealBench locally' on 2025-09-21. Only key found across 622 candidate files + commit history + GitHub code search (UUID prefix 2abd02c3-4e11 appears nowhere else).",
    "base_url": "https://maas-apigateway.dt.zte.com.cn/model/qwen3-coder-480b/v1",
    "models": ["Qwen3-Coder-480B-A35B-Instruct"],
    "auth": "Bearer",
    "status": "RESTRICTED_IP",
    "note": "NO PUBLIC ENDPOINT EXISTS (confirmed 2026-08-03). Network-level IP allowlist, not path routing: gateway IP 112.86.247.177 accepts TLS handshake but black-holes all HTTP payload from external source IPs (0 bytes, timeout). The _remote.py scripts explicitly strip proxy env vars (NO_PROXY=*) confirming they only run inside ZTE corp network. Public-host enumeration results: maas-apigateway.zte.com.cn / .zx / .prod / maas.zte.com.cn all NXDOMAIN; api.zx.zte.com.cn (47.106.172.209) and apigw.zte.com.cn (202.103.147.189) also black-hole HTTP; aistudio.zx.zte.com.cn returns 403 (WAF, no API); chat.zx.zte.com.cn returns 502 (backend down); aip.zte.com.cn is the public marketing site; openlab.zte.com.cn is a static SPA; maas-openapi.wanjiedata.com is an unrelated third-party MaaS (rejects key as 'apiKey not found'). proxyhk.zte.com.cn:80 (ZTE HK egress) is internal-DNS-only. Key can only be used from inside ZTE corporate network/VPN.",
    "probe_date": "2026-08-03",
    "probed_hosts": [
      "maas-apigateway.dt.zte.com.cn -> 112.86.247.177 (IP-gated, TLS ok / HTTP black-hole; :80 returns S3C 502)",
      "api.zx.zte.com.cn -> 47.106.172.209 (IP-gated, all ports black-hole)",
      "apigw.zte.com.cn -> 202.103.147.189 (IP-gated, all ports black-hole)",
      "aistudio.zx.zte.com.cn -> 403 Forbidden (WAF; HTTP returns OpenResty default page)",
      "chat.zx.zte.com.cn -> 502 Bad Gateway (openresty, backend down)",
      "aip.zte.com.cn -> 119.23.85.186 (public marketing site, nginx 404 + Aliyun WAF)",
      "openlab.zte.com.cn -> static SPA (all paths return index.html)",
      "maas-openapi.wanjiedata.com -> unrelated third-party MaaS (400 'apiKey not found', independent keyspace)",
      "glm.zte.com.cn, maas.zte.com.cn, aiapi.zte.com.cn, aiapi.zx.zte.com.cn -> NXDOMAIN"
    ]
  }
]