ok it was my other websites ,mainly my vbulletin. thanks!
This was on a fresh install, on a new domain. It happen literally after install, so how can a hack on something that never exist even happen?
Unless you’re saying one of my other websites on the account have been hacked which is in return affecting this new install on a new domain.