Sustained high-volume automated API request pattern to new-api/one-api transfer station proxy infrastructure

Duo Tech@duotech

•updated Aug 6, 2026•1•0•16

Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.