Moatline

Your WordPress site sends visitors to a fake Microsoft support page

A customer tells you your website showed a red “Windows has been blocked” warning and a number to call. You open the site and see nothing wrong. This is how the Help TDS scam network works on WordPress sites, why you don’t see it, and how to find and remove it.

By the Moatline team at Next Nova Technologies · Published 29 October 2026 · 5 min read

Worried your site is affected?See what your visitors and Google see. Free, no sign-up, about 20 seconds.
Check my site free

The criminals behind this are known as Help TDS, a traffic network that sends stolen website visitors to tech support scams. GoDaddy’s security team documented its WordPress plugin in 2025, and in October 2026 Infoblox linked it to more than 20,000 scam pages hosted on Cloudflare Pages. The plugin is still being found on WordPress sites.

The signs

  • A visitor reports a scary full-screen warning that claims to be from Microsoft or Windows Defender, often with a beeping sound, a frozen-looking screen and a phone number to call.
  • The address bar showed a strange site, often ending in pages.dev, with /help/ and a long number in the address.
  • You can’t reproduce it. Opening the site yourself, on your phone or while logged in, shows your normal pages.

How it gets in and how it works

  1. A stolen administrator password. GoDaddy found the attackers logging in with real administrator details, then uploading and activating the plugin in about 22 seconds. No plugin flaw is needed, so a strong, unique password and two-factor login matter here.
  2. A fake plugin called woocommerce_inputs. It poses as a small WooCommerce add-on, hides itself from the Plugins screen and removes its Deactivate link. Other versions are pasted into the theme through the theme editor, or into a Custom HTML block.
  3. It asks Telegram where to send people. The plugin reads the newest web address posted in a public Telegram channel and redirects visitors there. If Telegram can’t be reached, it asks the attackers’ server instead. The criminals can change the scam address at any time without touching your site.
  4. It reports your administrators. Newer versions send your administrators’ usernames, email addresses and your site address to the attackers. Passwords aren’t sent, but those email addresses can be matched against stolen password lists.
  5. It updates itself. Version 2 and later download new copies of the plugin from the attackers every day.

Why you don’t see it

  • It waits a day. Redirects start 24 hours after the plugin is installed, so the break-in and the symptoms don’t line up.
  • Once per visitor. A cookie stops the same person being redirected again for a day.
  • Only some visitors. Versions documented by GoDaddy picked new visitors from search engines, and some only desktop users in the US, Canada and Japan. Infoblox saw lures that only appear on weekdays, 9 am to 6 pm US Eastern time, when the call centre is open.

Check your site

  1. Plugins folder. In your host’s file manager or over SFTP, open wp-content/plugins and look for woocommerce_inputs, or any folder you don’t see on the Plugins screen.
  2. Site root. Look for files with 32-character names made of numbers and letters a–f and no extension, such as fa9a7ba3d8e48b74b57af9e70aa419ab. The plugin keeps the current scam address in them.
  3. Database. In phpMyAdmin, look for a table ending in ip_tracking (for example wp_ip_tracking) and an option called custom_redirect_install_date in wp_options.
  4. Theme and blocks. Search your theme files and Custom HTML blocks or widgets for t.me/s/, pinkfels or window.location.replace.
  5. Administrators. Go to Users, filter by Administrator and check every account. Our unknown admin user guide shows how to find hidden ones.
A file scan that only compares WordPress core files with the originals won’t find this: the fake plugin is a separate folder and leaves core alone.

The free Moatline Malware Scanner 1.3.3 and newer finds the fake plugin, its database entries, its addresses in files, posts and widgets, and code that reads a redirect address from a Telegram channel.

Clean it up

  1. Back up the files and database as they are.
  2. Delete the woocommerce_inputs folder over SFTP or the file manager, and the 32-character cache files in the site root. Deleting from the dashboard may not be possible because the plugin hides.
  3. Clean the database: drop the ip_tracking table and delete the custom_redirect_install_date option.
  4. Lock the attackers out. Change every administrator password, log everyone out, change the security keys in wp-config.php and turn on two-factor login. They had a working password, so this step matters most.
  5. Check the rest of the site for anything else added with that login: other plugins, must-use plugins in wp-content/mu-plugins, new administrators and theme changes. Our malware removal guide has the full checklist.
  6. Test as a visitor: a private window, a desktop browser, arriving from a Google search.

If a visitor called the number

The people on the phone are scammers. They ask the caller to install remote-access software, then charge for fake repairs or take over online banking. Anyone who called should hang up, uninstall any remote-access tool they were asked to install, run a full antivirus scan, change passwords from a different device and call their bank if they paid or shared card details. In the US, scams can be reported at reportfraud.ftc.gov.

Related: WordPress redirects to spam sites and fake CAPTCHA malware on WordPress.

Sources: GoDaddy Security, “Help TDS and its malicious plugins redirect thousands of sites to tech support scams” (August 2025); Infoblox Threat Intel, “Inside Help TDS” (October 2026).

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Is my site infected if only one customer saw the warning?
Assume so until you have checked. This redirect shows each visitor the scam page once and then hides from them for a day, and some versions only show it on desktop computers or during US business hours, so most people, including you, never see it.
Is woocommerce_inputs part of WooCommerce?
No. The real WooCommerce plugin lives in a folder called woocommerce and never installs a separate “woocommerce_inputs” plugin. A folder with that name is the scam plugin.
Can I just deactivate the plugin?
No. It hides itself from the Plugins screen and removes the Deactivate link. Delete the whole folder over SFTP or your host’s file manager, then change every administrator password, because it got in with one.
Does Cloudflare host this scam?
The scam pages run on free Cloudflare Pages sites (addresses ending in pages.dev) that the criminals create in bulk. Infoblox counted more than 20,000 of them. Cloudflare is being abused here, not involved.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →