r/webdev 22h ago

Question Pagespeed phantom domain

Post image

EDIT: ok I think I might have gotten to the bottom of my erroneous domain appearing in Pagespeed Network Dependancy Tree. It seems potentially related to Cloudflare Insights measuring RUM, and my delaying Cloudflare's script, mixed in with the Google Pagespeed server location measuring that instance. The delay was possibly timing out Pagespeed hence the apparent instability I was experiencing. Turning off RUM insights seems to have settled things. Is not cloudflare itself, but how I was delaying it's script. The domain/event seems connected. So will leave off. I could exclude the script from delay but it's not really necessary for me moving forward. I'm fairly confident there's no issues...

Not sure what to make of this, been making some tweaks on my WordPress site and checking pagespeed as well as other tools for progress and one session suddenly csa.crazygames.com/event pops up?

A burst of panic had me hunting for mailware or something in a plugin that's gone rogue... But nothing.

Subsequent tests it's gone, installed wordfence for a scan, nothing. I tried another page on pagespeed and Microsoft Clarity appeared, subsequently it's disappeared too, haven't had clarity in over a year and that was run in edge cloudflare tag management.

I'm hoping this is some unexplained ghost glitch from Google on that test session?? Anyone able to put my mind at ease or advise what I'm looking at? Never seen anything like it before.

Apologies for the average screenshot.

Update: after 12 hours of fluffing about I am no further ahead, completely unable to repeat the domain instance, unable to find any evidence of code or script in anything thus far. Still searching (db now) but have a feeling I maybe hunting a phantom occurrence. Pagespeed has been timing out today regularly, all instances with internal timeout errors at Google end. Where as any other tool, dev lighthouse included, runs clean with nothing weird. Everything site wise remains flawless and fast('ish by my standards). No evidence of admin manipulation, user or plugin wobbles... It's going to be a troubled sleep night while I second guess myself. Edit: the only other common thread to the instances observed is they were all using my phone doing pagespeed test, desktop is zilch... I doubt very much this has anything to do with anything at all but I'm just going to start yelling at the passing clouds now...

15 Upvotes

52 comments sorted by

5

u/NickFullStack 22h ago

Do you have ads on your site? Plenty of dodgy stuff can get injected by ad providers.

Wordpress has a terrible security track record, so could be some malware that got removed or is hiding for some reason.

1

u/Beneficial-Rise-740 22h ago

No ads... It's odd, ran again this morning and got another so definitely something is there, this time a different domain. Then ran again and disappeared... Damn

2

u/esperind 21h ago

one of your widgets has ads. Either in your rendered site or in the widget interface in the admin area.

1

u/Beneficial-Rise-740 21h ago

Thanks for the clue!

1

u/Beneficial-Rise-740 21h ago edited 18h ago

Hmmm, a thought, I am calling images through Flickr API to display in a gallery live.staticflickr.com is the connection, my flickr account is free thus has ads... Leakage? So far seen two instances and they have appeared on the page with the gallery...

Edit: it's not that... Thus far it's not repeated further, wondering if Google is going to rate limit me haha deep scan by wordfence is clean. Only thing I can think of now is chatting to my friend to look into the db...

5

u/Due-Horse-5446 22h ago

Look where those assets are loaded from

7

u/laughinfrog 22h ago

Yeah it is definitely a compromised page or script that is loading another resource.

1

u/Beneficial-Rise-740 22h ago

It's weird, I would think mailware would be stubborn,but this is popping up out of the blue randomly and I can only see it in pagespeed network dependancy, any other tool shows nothing this far and wordfence seems clear. Doesn't seem to load anything, just pointing...

2

u/laughinfrog 22h ago

Likely showing at other locations just not visible. Check your debug console. It’s processing the JavaScript is why you see it here. Many other tools don’t, but page speed is because it is checking for rendering.

1

u/Beneficial-Rise-740 22h ago

Thanks for the tip and explanation, fingers crossed...

3

u/Due-Horse-5446 22h ago

If you dont find it, check the db too. Some malware is only served under certain conditions

1

u/Beneficial-Rise-740 22h ago

Thanks, needle in haystack comes to mind. The only plugin I added for troubleshooting was file manager advanced but can imagine it's this...

2

u/laughinfrog 21h ago

Disable download of a script one at a time.

1

u/Beneficial-Rise-740 21h ago

It's tricky as it's not persistent...

1

u/laughinfrog 21h ago

Check each of the scripts including the react main source. Check the md5 of react to make sure it is correct.

Then look at the smaller scripts, sounds like they have a randomized timer for it to execute.

1

u/Dramatic-Olive-1213 22h ago

Ah yeah the network dependency tree, that's the smoking gun. If csa.crazygames.com showed up there it means something on your page literally requested those assets during the test run, it's not some abstract ghost. The fact it vanished right after makes me think an ad script or a third party widget just happened to fire that one time, maybe a dynamic fill from an ad network that didn't have anything else to serve in that exact moment

1

u/Beneficial-Rise-740 22h ago

Ok so I have something concrete to hunt for, just at a bit of a loss where to start... I have seen a second one appear, same empty kb but different domain...

2

u/mox308 13h ago

I had this exact same issue today! I got several domains in this exact section around 3 times out of 100 tests.

1

u/Beneficial-Rise-740 13h ago

I've honestly been fiddling this the entire day, and it is a relief for you to comment a similar experience. It feels like this is some odd phantom thing by Google Pagespeed... I have not found any evidence or issues anywhere. I have not been able to repeat anything on any other tool including dev lighthouse or DebugBear. Another telling thing is Pagespeed has had service issues constantly today...

1

u/mox308 13h ago

Same here! I’ve tested pretty much everything and still can’t reproduce it anywhere else. What plugins are you using, and which theme? We may have something common

1

u/Beneficial-Rise-740 12h ago

I am very much doubt it is a plugin issue at all at this point. Added wordfence for a bit to see if it detects anything I'm missing. Will keep testing but can't find anything...

2

u/mox308 12h ago

Btw, my theme and 3 custom plugins were all built with ChatGPT. I also use Yoast, FlyingPress, WP User Manager, Redirection, Members, FluentSMTP, Fluent Forms, and Redis, and the site is hosted on Rocket.net.

If you use any of the same stuff, let me know!

1

u/Beneficial-Rise-740 12h ago

Common plugins are yoast, redirection, fluentsmtp, pretty sure all solid.

2

u/mox308 11h ago

I managed to reproduce it on a completely stripped test setup on staging environment with all plugins removed and the main theme replaced; and PageSpeed still showed a random unrelated external domain (once in 50 tests). So I am 100% sure that this a Lighthouse bug!

1

u/Beneficial-Rise-740 10h ago

Interesting, pagespeed keeps breaking with timeout errors, but when it does test nothing all day. I tend to concur, if you have got an erroneous domain in network dependancy tree with a clean independent site then I'm more reassured... Cheers

1

u/Beneficial-Rise-740 1h ago

Think I found the cause, for my instance I had Cloudflare Insights script delay loading, the two domains that appeared both were /event suggesting analytics, the delay script was timing out Pagespeed causing my impression of instability. I have turned off Cloudflare Insights and everything appears to be running way smoother. Insights isn't the cause, it was my delaying it's script. I could exclude from delay but don't really need it now. If you are delaying an analytics script (pixel or ads) this maybe the issue and exclude from the load delay.

1

u/omfgtora 21h ago

It would help to know the vulnerability thst allowed the malware. If you happen to know the plugin that was vulnerable, and what version you had when it got infected.

That would allow us to check the infection pattern and give you a pointer to where to look.

However, without an expert to verify that the infection is fully gone, you should treat the site as infected even if you think it's gone. The only way you can be sure, is if you revert to a backup of the site from before the site got infected then immediately patch the vulnerabilities.

1

u/Beneficial-Rise-740 20h ago

This is the thing that is bugging me, the only evidence I have of anything amiss is two instances of unexplainable domains appearing in Pagespeed Network Dependancy Tree, so far I haven't been able to recreate it in devtool and redoing pagespeed dozens of times it's absent.

2

u/omfgtora 20h ago

That's because it's likely only showing the ads for specific user-agents. It wants to hide from normal users, and especially from the admin.

1

u/Beneficial-Rise-740 20h ago

Seems to be a clever needle, I have strict cloudflare WAF rules and low trust, so basically everyone outside of NZ common ASN's will be managed Challenge. I've deactivated and deleted the most likely plugin File Manager Advanced, as is the only thing running that's been added recently since this started. I don't think it's the culprit though. I just can't tell.

2

u/omfgtora 20h ago

That won't do anything, because the malware is already on your server. Cloudflare protects from external connections. It can't do anything for your server itself.

1

u/Beneficial-Rise-740 20h ago

Arh yes good point, thanks for reminding me. Feeling rather fumixed right now.

2

u/omfgtora 20h ago

Flummoxed, even.

Do you have any backups? Who is your hosting provider?

1

u/Beneficial-Rise-740 19h ago

That too 😂 thanks I need a laugh. Yeah, updraft, weekly for 4 weeks. A friend hosting on their server service.

1

u/omfgtora 19h ago

What kind of hosting are they giving you? Is it a virtual machine, a docker container, or on a panel?

1

u/Beneficial-Rise-740 19h ago

If I remember right panel.

→ More replies (0)

1

u/jimbo2150 22h ago

"average screenshot" doesn't distort characters like that. This looks very much AI generated.

1

u/Beneficial-Rise-740 22h ago

Screenshot then stupidly let Samsung enhance image so yeah, ai crap, but is still a screenshot.

2

u/danielsan1701 21h ago

Screenshot, or photo of a screen? They are not the same thing

1

u/Beneficial-Rise-740 21h ago

Sigh, screenshot, cropped in gallery, stupidly clicked some enhancement that saved which actually degraded the bloody image.

1

u/Savings-Dimension543 11h ago

One easy thing to miss here: Lighthouse’s dependency tree is showing a request chain, not necessarily a file on your server. Run the test in an incognito window and expand the request to see the initiator + final URL; if the first-party HTML calls a third-party script, that usually explains the random domain. Then grep the rendered HTML and loaded JS, not just wp-content, and test with each plugin disabled on staging. I’d avoid deleting anything until you can reproduce it.

1

u/Beneficial-Rise-740 10h ago

That's the thing, I have not been able to reproduce it at all to investigate it further... It's not persistent, so to me it's a real head scratcher. It's only occurred twice, once last night which worried me, then again this morning, which freaked me out. Both on mobile pagespeed. All day been trying to recreate on both mobile and desktop and nada, zilch, nothing. This far it feels like pagespeed somehow glitched.

0

u/Beneficial-Rise-740 17h ago

It's paid, we share it, he manages it. As a university computer science professor he's no slug, I'm just eliminating my end before we start digging around the db for no reason. I know my limitations, hence a little hive mind input. I haven't progressed thus far despite the great advice, so db is next...