Hi @ScreenDave 

You will have to check your instrumentation code/pipeline to see where these properties are created and sent to Amplitude. These look like explicitly defined properties for your events in your project.

Re. the first seen issue, it could be the case that this user’s first event timestamp ( ms since epoch ) was set incorrectly in your instrumentation.

Hope this helps.

I am a single developer working on a very small project. I can assure you that I have not created anything like these properties or events, I have exactly 35 events that I send from the apps, but the events explorer shows that there are 109 in total.

Unless Amplitude SDK somehow grabs or generates them automatically? My app has nothing to do with PDFs, yet I have dozens of events seemingly about just that.

The values for app version also has a bunch of versions that I 100% have not had in my app. My app have had 1.0 to 1.6.5, which shows up. Alongside 2.5.21, 8.0.3, etc.

Again, this is a small app with maybe 5 files, built since at most 3 weeks by me and me alone. I guarantee that I have not had these versions, nor have I added these events or properties.

I haven’t come across cases where the SDK auto-generates events from the app. Not 100% sure, but this could be a case of a compromised API key from your project. Can you verify if these extra unrelated events have the same IP as the others? I would highly suggest raising a support request with the Amplitude Support Team to go deeper into this issue.

Can’t see how that would happen, someone compromising my amplitude ID of everything within a moments of me creating the project and starting to use it for … what?

Maybe someone have used a random number though and just sent it to anywhere who knows.

Will do that, I assumed they would answer here. Thanks