[turborepo + nextjs 16.0.7] I've got hacked, what should I do to keep the project?

[Fatdrfrog]

Summary

For the context: I've updated this projects nextjs version 3 days ago now what is still happening here:
By the image its kinda clear that my code doing something wrong. This is logs for 24 hours.
First thing, it spams my whole requests I am not sure why:

Second thing, It created some strange projects that looks like mine:

I am not sure what I should do, just delete project for now to stop this behavior? It eats trafic, and this goes to my wallet :(

Additional information

UPD1: I've definitely got hacked on another project (because forgot to upgrate Nextjs version there) that were sending builds every n seconds and that was probably the reason of super high traffic:

I already deleted that second project immediately, and now I am not sure what to do with the current, the first one.

UPD2: The logs that I listed previously probably because of just my coding skills, its not hacking issue but wrong folder creation of dynamic routes. But still, because of the second one, should I consider deleting first project and recreating again here, or do something else with it?

Example

No response

[icyJoseph]

That next-ai-front-... is it a protected deployment? You can check if standard deployment protection is on. This means, only your production deploy can be seen publicly. All preview deployments require Vercel log in and team membership.

You should go to deployments, and see from there, who created next-ai-front... and why.

[Fatdrfrog]

The only author is me:

• Based on build settings seems I'm fine, in Deployments tab all of the recent deployments are mine.
• The one that in problem screenshot and the one that Ive attached here has different id's, maybe its just vercel id rotation of non bought domains?
• The reason of high traffic was violation of the second project (it was deployed not by me but by other actor every n seconds), if I get correctly?

If the problem was the other project (that I've deleted), and this project is totally fine, I will close the issue, or is there any other ways to find if it's still on high risk?

[icyJoseph]

I think so, as long as you have latest versions on your publicly available deploys. I am not sure I understand what happened to your second project. Ever time you push, Vercel creates a new deploy. These are preview type deployments, only available to you as per standard protection.

The reason of high traffic was violation of the second project (it was deployed not by me but by other actor every n seconds), if I get correctly?

This part I don't follow, but if you have deleted and restarted fresh with latest versions, I guess, that's it.

[Fatdrfrog]

Clarifying:
The reason of high traffic was violation of the second project (it was deployed not by me but by other actor every n seconds), if I get correctly?

The second project that I deleted was 100% hacked:

• High traffic came from constant redeployment and high load of requests on each, I am not sure why it works this way, but it probably some sort of mining, redeploying comes probably to not get spotted by automatic security systems.
• The redeplyoment was done by a bot (actor) that wasn't created by me but by the hack entity.