If you stored keys on Zeabur, the attacker may have used them against your accounts, which Zeabur can't see. Zeabur says the attacker relied heavily on rotating proxies, so the IPs below are representative only. Search back to Oct 14, 2026, or to Sept 1 for GCP dedicated servers.

1. AWS CloudTrail: filter userAgent for Boto3/1.43.111 (Zeabur saw it as "Linux 6.12.86") and source IPs 23.106.46.239, 102.244.78.57, 103.237.102.191, 103.112.139.162, 45.146.232.28. Look especially at GetCallerIdentity key checks, bedrock:InvokeModel attempts and S3 ListBuckets/GetObject.
2. GCP / other clouds and AI providers: look for the same IPs in admin-activity logs and in API-key usage dashboards (OpenAI, Anthropic, Google AI and similar). Zeabur suspects at least one leaked OpenAI key was used for image generation on Oct 16.
3. Servers: check /root/.ssh/authorized_keys for a key with the comment @zeabur-pentest (fingerprint SHA256:EdBc0uephoOMemIRKK0SRV2TRR45n52tJm1yErVU1iM) and auth logs for SSH logins from 216.98.11.198, 45.58.38.175, and (early September, link unconfirmed) 31.57.201.201. Also review the google-sudoers group, crontab, systemd units and k3s workloads.
4. Databases: outbound connections to 52.220.72.188, the callback address of the program planted in PostgreSQL. Also look for PostgreSQL roles, functions, triggers, extensions or scheduled jobs you don't recognize.
5. GitHub: in org audit logs, look at actions by the Zeabur GitHub App between Oct 15 15:05 and 18:54 UTC: unexpected clones or pushes, new deploy keys, modified webhooks.

Any hit means the related credential was used. Revoke it at the provider, then follow the rotation steps in Zeabur's report.