My website was hacked, with the following code added to the end of the page:

<img heigth="1" width="1" border="0" 

(The id had an 8 digit number in place of the ########)

The link didn't work. Also, the page would crash until I removed the link. What else do I need to be worried about? Why would hackers put such a poor link on a website?


imgddd.net shows up on MalwareDomains.com's list (as of 4/26/2011) as a malware distributor; it appears as though the t.php script has been taken down, however, the main page remains active with what appears to be a Flash-based exploit; I'm not interested in seeing it in action, and would advise against testing it out yourself.

There are a variety of maliciously-crafted image file exploits in the wild - this was probably an attempt to launch one.

If your browser crashed, there is a possibility your machine was compromised by viewing the image file in question. Take appropriate precautions by scanning your machine for viruses, malware, and rootkits.

You will also need to audit your hosting account to determine how the malicious image link was added to your page - start by contacting your hosting provider.


It is not enough to simply delete that snippet of code. And this is not what you do first.

  • I didn't find a .log file, or notice any recent suspicious files either. Strange. – Ari May 17 '11 at 5:12
  • @Ari, 1. the .log directory and other doorway files are not always being created on hacked sites 2. the .log directory and .php files can be created in some subdirectory of your site, so make sure to scan them all for suspicius content 3. I confirm that this hack uses stolen FTP passwords. – Denis May 17 '11 at 10:19
  • and stop using FTP, start using SFTP – MiPnamic May 18 '11 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.