Doesn’t that require them to register an account using the browsers they’ve compromised? If anthropic adds identity verification won’t that cut that down. Maybe it will let them use Gemini inside of chrome

Residential IPs don’t even matter. Developers use devboxes, use Claude Code CLI on servers from just about every cloud, etc.

There’s probably a decent volume of customers who just buy Claude Max and spend most if not nearly all of their sessions via Claude Code, and it’s not uncommon for power users to be working on multiple concurrent projects/tasks/codebases at the same time.

How do you really block this without also impacting your core market of developers?

Probably some business will popup, like: "rent part of your unused subscription", or even: "proxy tokens with a premium", eg. 5.5 USD on Opus 4.7 paid by the distiller to the user, that will then only spend 5 USD.

No, they could easily buy legitimate, already registered accounts and use VPNs.

Why use VPNs? Just use a public cloud like AWS, or something like Linode and Vultr and all that.

Developers use devboxes on these clouds all the time, it’s totally normal behavior.

Most people buying these Chinese resold tokens are probably using it for coding anyway, so you don’t want the Claude.ai chat system prompt.