Unexpected logins, traffic or spending
Review account and guest evidence, then secure the affected access.
Common symptoms
Unknown login, account compromised, unusual traffic, unexpected spend, leaked SSH key, suspicious process, security alert
What to check
- Record the time and inspect account activity, security settings, affected servers and billing. Check whether the login, traffic or spend matches your own work or a linked service.
- Secure the affected account through its available security controls and review linked sign-in methods. In the guest, inspect logins, processes and installed SSH keys while preserving another trusted access path.
- Save sanitized evidence and contact support about the affected server or charge. Review the impact before stopping a service or changing access; do not erase the guest through reinstall merely to remove evidence.
Common questions
I see an unknown login. What evidence should I preserve?
Save the activity time, source information and affected resource after removing secrets. Review your account security and guest access, and report the event. Keep useful logs before making destructive changes.
Will reinstalling immediately resolve unexpected traffic or charges?
It can destroy guest data and evidence without securing a compromised account or explaining a charge. Review account access, guest processes and billing first, then choose a recovery action based on the findings.
Open the relevant page
Before contacting support
Include the server or account reference, time with timezone, unexpected activity and sanitized log or charge details. Never send passwords, tokens, private keys, TOTP codes or backup codes.
Keep secrets out of support requests · Remove passwords, private keys, access tokens, TOTP codes, backup codes and full payment details from screenshots and logs. Share the server or order name, time with timezone and exact sanitized error.
This opens an editable ticket draft. Nothing is sent automatically.