Because XenForo is so popular, attackers specifically scan for config.php files or database dumps from XenForo installations. A compromised XenForo database contains:
Statewins became particularly known for aggregating leaks from:
The second part of the keyword, "Statewins," refers to a notorious data leak website and archiving platform.