Because XenForo is so popular, attackers specifically scan for config.php files or database dumps from XenForo installations. A compromised XenForo database contains:
References
"StateWins - The premier XenForo community for [Game Name]. Track your wins, engage in forum discussions, and see live server states. Join the competition today!" A Note on "XenForo StateWins Extra Quality" xenforo statewins
These packs are frequently hosted as "V.I.P." or "Premium" resources, requiring users to reach a certain rank or register to view the hidden links. Because XenForo is so popular, attackers specifically scan