[Sahbak]

At a previous company, a new employee accidentally commited his aws credentials to a public github repo, which had instance creation capabilities. It got scraped and we had the max amount of instances created at every zone (we assume for mining). I assume you have bots scraping public sites for those creds at all times.