{"slug": "the-ai-got-it-wrong-then-got-it-right", "title": "The AI Got It Wrong — Then Got It Right", "summary": "A follow-up investigation by a website owner found that a hidden redirect attack on his sites was caused by a compromised Ad Inserter plugin storing malicious JavaScript in the WordPress database, not by the Chinese analytics script 51.la initially blamed. The attack targeted WeChat users via a cookie-based cooldown, and the AI's first investigation failed because it searched files rather than database-stored plugin settings.", "body_md": "*A follow-up to: My Website Was Secretly Redirecting Chinese Visitors — I Used AI to Investigate*\n\nIn my last post on this topic, I described how AI helped me track down a hidden redirect attack on my website. We ran through the files together, found a suspicious Chinese analytics script called 51.la, removed it, and the redirects stopped.\n\nI called it solved. The AI called it solved.\n\nWe were wrong.\n\nOr at least: we blamed the wrong suspect. The redirect stopped, but not because 51.la was the cause. A few weeks later, the same attack appeared on another site I run — no 51.la anywhere — and this time, AI helped me find what we should have been looking for the first time: a compromised WordPress plugin hiding its payload in the database, invisible to every file-level scan.\n\n## The Same Attack, No 51.la This Time\n\nThe second site — a blog I manage — started showing identical symptoms. Mobile visitors using WeChat’s built-in browser got redirected to a gambling site after clicking any link. Desktop visitors saw nothing. International IPs saw nothing. Wordfence scanned clean.\n\nI ran the same investigation:\n\n| Location | Result |\n|---|---|\n`.htaccess` |\nClean |\n`wp-config.php` |\nClean |\n| Theme files | Clean |\nGlobal search for `MicroMessenger` |\nNothing found |\n| Global search for malicious domain | Nothing found |\n\nNo 51.la. No external scripts at all. And still: completely clean files.\n\nSo I asked the AI to help again — but this time with a different instruction: *don’t look at files, look at what the page actually outputs.*\n\n## The Real Culprit: Ad Inserter\n\nWhen I fetched the raw HTML of an affected page using a Chinese IP and a WeChat User-Agent, the AI spotted it immediately: an 83KB JavaScript blob being injected into every page that contained:\n\n```\nWeChat: \"\\\\bMicroMessenger\\\\b\"\n```\n\nPlus a link-click hijacker. Plus a daily cooldown mechanism using cookies — which explained why the attack only fired once or twice per day and then went silent.\n\nThe code wasn’t in any file. It was stored in the WordPress database, in the `wp_options`\n\ntable, as configuration data for an installed plugin: **Ad Inserter**.\n\nAd Inserter is a legitimate plugin with half a million active installs. Someone had gotten into the site and configured it to inject a malicious ad “block” that:\n\n1. **Detected WeChat’s browser** — only users with `MicroMessenger`\n\nin their User-Agent got targeted 2. **Applied a cookie-based cooldown** — each device only saw the redirect once per day, making testing extremely difficult 3. **Hijacked link clicks** — not a page redirect, but an event listener on every anchor tag 4. **Left no trace in the files** — because WordPress plugin settings live in the database, not on disk\n\nThe modification timestamp on Ad Inserter’s files was three weeks earlier than everything else on the server. That was the tell.\n\n## Why the AI Got It Wrong the First Time\n\nThe first investigation failed because I constrained it to the wrong search space.\n\nI said: *search the files.* The attacker hid the payload in the database. The AI did exactly what I asked — and found nothing, so it looked for the next-most-suspicious thing in scope: an external script from a Chinese analytics service with a known bad reputation.\n\n51.la looked guilty. It was loaded on every page. It called home to Chinese servers. Its domain showed up in redirect chains when researchers analyzed it. And when I removed it, the attack appeared to stop.\n\nBut “appeared to stop” isn’t the same as “actually stopped.” The most likely explanation: the attacker had already moved the payload to another site, or the cookie-based cooldown had simply exhausted its daily quota by the time I started testing post-removal.\n\n## About 51.la\n\nTo be fair to the AI — and to myself — 51.la is not exactly an innocent bystander.\n\nIts reputation in the web security community is genuinely bad. It has appeared in multiple redirect chain analyses as either a vector or a cover for malicious traffic. Forums are full of reports from site owners who removed 51.la and saw problems stop. Whether it actively injects code, passively enables third-party injection, or simply attracts the same ecosystem of attackers who compromise WordPress sites is unclear. But “remove 51.la” is standard advice in Chinese WordPress communities for a reason.\n\nSo: removing it was the right call. We just shouldn’t have stopped there.\n\n## What the Cookie Timing Actually Means\n\nThe “fires once, then goes quiet” behavior is a deliberate evasion tactic.\n\nIf a redirect fires on every single visit, site owners get reports within hours and investigate. If it fires once per device per day using a cookie, most users assume they tapped something accidentally. They close the tab and forget about it. The attack runs for weeks.\n\nThe cookie also means: – **Regular visitors never see it** — they already have the cookie set from their first visit – **The site owner never sees it** — too many prior visits, always has the cookie – **Testing more than once with the same phone gives a false clean result**\n\nTo reproduce the attack, you need: Chinese IP + WeChat User-Agent + no prior cookie from that domain. That combination is almost impossible to replicate from a typical developer setup, which is exactly the point.\n\n## What Actually Fixed It\n\n1. Deactivated and deleted Ad Inserter 2. Cleared the LiteSpeed cache (critical — cached pages continue serving the injected JS even after the plugin is gone) 3. Confirmed with a WeChat scan from a Chinese IP: clean\n\nThe redirect has not reappeared.\n\n## How to Catch This Next Time\n\nIf you’re investigating a similar attack on a WordPress site and the files all look clean, check these before concluding it’s an external script:\n\n– **Fetch rendered page source** from the attacker’s target environment (correct IP, User-Agent, fresh device with no cookies) – **Check plugin modification timestamps** — anything recently changed that you didn’t touch is suspicious – **Review what active plugins inject** into page output — read the rendered HTML, not the plugin files – **Clear caches before retesting** — otherwise you’re testing a cached version of the attack\n\nThe attack is designed to survive file-level scanning. The page output is where it shows up.\n\n## The Honest Verdict\n\nThe AI made a confident call that turned out to be wrong. It blamed 51.la because that’s where the evidence pointed, given what we were searching. It didn’t know to look in the database.\n\nBut when I gave it the right input — the actual rendered page HTML from an affected device — it found the injected payload in seconds and identified exactly what was happening.\n\nThat’s the real lesson: AI-assisted investigation is only as useful as the evidence you put in front of it. Garbage in, confident-but-wrong answer out. Good evidence in, useful answer out.\n\nThe tool is fine. The process needed fixing.\n\n*Both sites are now clean. I’ve audited all installed plugins, reduced plugin count significantly, and changed the investigation protocol for any future incidents: start with rendered page source, not file contents.*\n\n**Related Reading**", "url": "https://wpnews.pro/news/the-ai-got-it-wrong-then-got-it-right", "canonical_source": "https://ordinarymantrying.com/ai-wrong-wordpress-plugin-wechat-redirect-attack/", "published_at": "2026-08-14 11:17:34+00:00", "updated_at": "2026-08-14 11:24:51.591733+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "ai-ethics"], "entities": ["Ad Inserter", "WordPress", "51.la", "Wordfence", "WeChat"], "alternates": {"html": "https://wpnews.pro/news/the-ai-got-it-wrong-then-got-it-right", "markdown": "https://wpnews.pro/news/the-ai-got-it-wrong-then-got-it-right.md", "text": "https://wpnews.pro/news/the-ai-got-it-wrong-then-got-it-right.txt", "jsonld": "https://wpnews.pro/news/the-ai-got-it-wrong-then-got-it-right.jsonld"}}