[Forum] vBulletin css.php hack?

[zeropaid]

I recently moved off the vBulletin platform, while I was tailing access log files I noticed something that didn't make sense. I started seeing a heavy dose of requests for a file called css.php in my old vBulletin installation directory. The requests for this file are happening all over the site.

Let me first say that my vBulletin installation has been hacked multiple times in the past, thus one of the many reasons I am moving on to a different forum software.

Has there been any recently hacking activity on VB4 that is targeting css.php?

Could the hack live somewhere else on the dedicated server? I have grep'd all the files on the server and can find no instance of css.php or the request in code.

Right now I am 301'ing all my requests to the new software, but that does not address the problem. Why is this file being called when vBulletin is long gone.

And yes, I have deleted every known cache file from local to cloudflare.

[Wayne Luke]

If you deleted vBulletin there is no reason this file is being called. Other systems might use a similarly named file or an old system that tied into vBulletin would be using. There are no known hacks of this file at this time. Most likely reason is it is being called from something like Google Cache.

[zeropaid]

Most likely reason is it is being called from something like Google Cache.

It's being called per page request when browsing the site. The weird part is it's being called outside of the directory where VB lived. Basically on all pages of the site. The file shouldn't be called here. That's why I am trying to dig a little deeper.

[AcemanWolf]

I was searching on YouTube that on. Only vBulletin forum are getting hacked are vBulletin null. They have no security and no license. It's are easy to hack with NULL forum.