Welcome to the Q&A Forum

Hi there There's really no way of telling without a link to your client's site. Here's a great Q+A on StackExchange where users offer their ideas. Including... They find new sites by: Crawling and looking for signatures of known software. Usually this is a snippet of text like a copyright or a meta tag but it could be any consistent identifier. This usually applies to blog and forum software. Manual inclusion. Human beings, whose labor is cheap in many parts of the world, look for known software or forms that are easily exploitable and add them to a database. This usually applies to custom registration and contact forms. They buy lists. Just like email addresses are sold by spammers, known vulnerable or preferred target site lists are sold as well. So, it really could be a lot of things, but I wouldn't jump to inclusions. Just refer the resources above and start doing what you can! Hope this helps a bit - good luck!