I think I was part of a model distillation attack
sebastianmarines.com
sebastianmarines.com
I do not think distallation works like this; could be wrong though.
Or for the pirate open router service people, part of the "distillation" is just logging all conversations and selling that as training data to labs with less scruples.
Primary seems it's just a stolen api key and there's likely a broker running some kind of pirated router. Which makes the most sense with random unconnected testing.