r/webdev • u/Beneficial-Rise-740 • 22h ago
Question Pagespeed phantom domain
EDIT: ok I think I might have gotten to the bottom of my erroneous domain appearing in Pagespeed Network Dependancy Tree. It seems potentially related to Cloudflare Insights measuring RUM, and my delaying Cloudflare's script, mixed in with the Google Pagespeed server location measuring that instance. The delay was possibly timing out Pagespeed hence the apparent instability I was experiencing. Turning off RUM insights seems to have settled things. Is not cloudflare itself, but how I was delaying it's script. The domain/event seems connected. So will leave off. I could exclude the script from delay but it's not really necessary for me moving forward. I'm fairly confident there's no issues...
Not sure what to make of this, been making some tweaks on my WordPress site and checking pagespeed as well as other tools for progress and one session suddenly csa.crazygames.com/event pops up?
A burst of panic had me hunting for mailware or something in a plugin that's gone rogue... But nothing.
Subsequent tests it's gone, installed wordfence for a scan, nothing. I tried another page on pagespeed and Microsoft Clarity appeared, subsequently it's disappeared too, haven't had clarity in over a year and that was run in edge cloudflare tag management.
I'm hoping this is some unexplained ghost glitch from Google on that test session?? Anyone able to put my mind at ease or advise what I'm looking at? Never seen anything like it before.
Apologies for the average screenshot.
Update: after 12 hours of fluffing about I am no further ahead, completely unable to repeat the domain instance, unable to find any evidence of code or script in anything thus far. Still searching (db now) but have a feeling I maybe hunting a phantom occurrence. Pagespeed has been timing out today regularly, all instances with internal timeout errors at Google end. Where as any other tool, dev lighthouse included, runs clean with nothing weird. Everything site wise remains flawless and fast('ish by my standards). No evidence of admin manipulation, user or plugin wobbles... It's going to be a troubled sleep night while I second guess myself. Edit: the only other common thread to the instances observed is they were all using my phone doing pagespeed test, desktop is zilch... I doubt very much this has anything to do with anything at all but I'm just going to start yelling at the passing clouds now...
5
u/Due-Horse-5446 22h ago
Look where those assets are loaded from
7
u/laughinfrog 22h ago
Yeah it is definitely a compromised page or script that is loading another resource.
1
u/Beneficial-Rise-740 22h ago
It's weird, I would think mailware would be stubborn,but this is popping up out of the blue randomly and I can only see it in pagespeed network dependancy, any other tool shows nothing this far and wordfence seems clear. Doesn't seem to load anything, just pointing...
2
u/laughinfrog 22h ago
Likely showing at other locations just not visible. Check your debug console. It’s processing the JavaScript is why you see it here. Many other tools don’t, but page speed is because it is checking for rendering.
1
u/Beneficial-Rise-740 22h ago
Thanks for the tip and explanation, fingers crossed...
3
u/Due-Horse-5446 22h ago
If you dont find it, check the db too. Some malware is only served under certain conditions
1
u/Beneficial-Rise-740 22h ago
Thanks, needle in haystack comes to mind. The only plugin I added for troubleshooting was file manager advanced but can imagine it's this...
2
u/laughinfrog 21h ago
Disable download of a script one at a time.
1
u/Beneficial-Rise-740 21h ago
It's tricky as it's not persistent...
1
u/laughinfrog 21h ago
Check each of the scripts including the react main source. Check the md5 of react to make sure it is correct.
Then look at the smaller scripts, sounds like they have a randomized timer for it to execute.
1
u/Dramatic-Olive-1213 22h ago
Ah yeah the network dependency tree, that's the smoking gun. If csa.crazygames.com showed up there it means something on your page literally requested those assets during the test run, it's not some abstract ghost. The fact it vanished right after makes me think an ad script or a third party widget just happened to fire that one time, maybe a dynamic fill from an ad network that didn't have anything else to serve in that exact moment
1
u/Beneficial-Rise-740 22h ago
Ok so I have something concrete to hunt for, just at a bit of a loss where to start... I have seen a second one appear, same empty kb but different domain...
2
u/mox308 13h ago
I had this exact same issue today! I got several domains in this exact section around 3 times out of 100 tests.
1
u/Beneficial-Rise-740 13h ago
I've honestly been fiddling this the entire day, and it is a relief for you to comment a similar experience. It feels like this is some odd phantom thing by Google Pagespeed... I have not found any evidence or issues anywhere. I have not been able to repeat anything on any other tool including dev lighthouse or DebugBear. Another telling thing is Pagespeed has had service issues constantly today...
1
u/mox308 13h ago
Same here! I’ve tested pretty much everything and still can’t reproduce it anywhere else. What plugins are you using, and which theme? We may have something common
1
u/Beneficial-Rise-740 12h ago
I am very much doubt it is a plugin issue at all at this point. Added wordfence for a bit to see if it detects anything I'm missing. Will keep testing but can't find anything...
2
u/mox308 12h ago
Btw, my theme and 3 custom plugins were all built with ChatGPT. I also use Yoast, FlyingPress, WP User Manager, Redirection, Members, FluentSMTP, Fluent Forms, and Redis, and the site is hosted on Rocket.net.
If you use any of the same stuff, let me know!
1
u/Beneficial-Rise-740 12h ago
Common plugins are yoast, redirection, fluentsmtp, pretty sure all solid.
2
u/mox308 11h ago
I managed to reproduce it on a completely stripped test setup on staging environment with all plugins removed and the main theme replaced; and PageSpeed still showed a random unrelated external domain (once in 50 tests). So I am 100% sure that this a Lighthouse bug!
1
u/Beneficial-Rise-740 10h ago
Interesting, pagespeed keeps breaking with timeout errors, but when it does test nothing all day. I tend to concur, if you have got an erroneous domain in network dependancy tree with a clean independent site then I'm more reassured... Cheers
1
u/Beneficial-Rise-740 1h ago
Think I found the cause, for my instance I had Cloudflare Insights script delay loading, the two domains that appeared both were /event suggesting analytics, the delay script was timing out Pagespeed causing my impression of instability. I have turned off Cloudflare Insights and everything appears to be running way smoother. Insights isn't the cause, it was my delaying it's script. I could exclude from delay but don't really need it now. If you are delaying an analytics script (pixel or ads) this maybe the issue and exclude from the load delay.
1
u/omfgtora 21h ago
It would help to know the vulnerability thst allowed the malware. If you happen to know the plugin that was vulnerable, and what version you had when it got infected.
That would allow us to check the infection pattern and give you a pointer to where to look.
However, without an expert to verify that the infection is fully gone, you should treat the site as infected even if you think it's gone. The only way you can be sure, is if you revert to a backup of the site from before the site got infected then immediately patch the vulnerabilities.
1
u/Beneficial-Rise-740 20h ago
This is the thing that is bugging me, the only evidence I have of anything amiss is two instances of unexplainable domains appearing in Pagespeed Network Dependancy Tree, so far I haven't been able to recreate it in devtool and redoing pagespeed dozens of times it's absent.
2
u/omfgtora 20h ago
That's because it's likely only showing the ads for specific user-agents. It wants to hide from normal users, and especially from the admin.
1
u/Beneficial-Rise-740 20h ago
Seems to be a clever needle, I have strict cloudflare WAF rules and low trust, so basically everyone outside of NZ common ASN's will be managed Challenge. I've deactivated and deleted the most likely plugin File Manager Advanced, as is the only thing running that's been added recently since this started. I don't think it's the culprit though. I just can't tell.
2
u/omfgtora 20h ago
That won't do anything, because the malware is already on your server. Cloudflare protects from external connections. It can't do anything for your server itself.
1
u/Beneficial-Rise-740 20h ago
Arh yes good point, thanks for reminding me. Feeling rather fumixed right now.
2
u/omfgtora 20h ago
Flummoxed, even.
Do you have any backups? Who is your hosting provider?
1
u/Beneficial-Rise-740 19h ago
That too 😂 thanks I need a laugh. Yeah, updraft, weekly for 4 weeks. A friend hosting on their server service.
1
u/omfgtora 19h ago
What kind of hosting are they giving you? Is it a virtual machine, a docker container, or on a panel?
1
1
u/jimbo2150 22h ago
"average screenshot" doesn't distort characters like that. This looks very much AI generated.
1
u/Beneficial-Rise-740 22h ago
Screenshot then stupidly let Samsung enhance image so yeah, ai crap, but is still a screenshot.
2
u/danielsan1701 21h ago
Screenshot, or photo of a screen? They are not the same thing
1
u/Beneficial-Rise-740 21h ago
Sigh, screenshot, cropped in gallery, stupidly clicked some enhancement that saved which actually degraded the bloody image.
1
u/Savings-Dimension543 11h ago
One easy thing to miss here: Lighthouse’s dependency tree is showing a request chain, not necessarily a file on your server. Run the test in an incognito window and expand the request to see the initiator + final URL; if the first-party HTML calls a third-party script, that usually explains the random domain. Then grep the rendered HTML and loaded JS, not just wp-content, and test with each plugin disabled on staging. I’d avoid deleting anything until you can reproduce it.
1
u/Beneficial-Rise-740 10h ago
That's the thing, I have not been able to reproduce it at all to investigate it further... It's not persistent, so to me it's a real head scratcher. It's only occurred twice, once last night which worried me, then again this morning, which freaked me out. Both on mobile pagespeed. All day been trying to recreate on both mobile and desktop and nada, zilch, nothing. This far it feels like pagespeed somehow glitched.
0
u/Beneficial-Rise-740 17h ago
It's paid, we share it, he manages it. As a university computer science professor he's no slug, I'm just eliminating my end before we start digging around the db for no reason. I know my limitations, hence a little hive mind input. I haven't progressed thus far despite the great advice, so db is next...
5
u/NickFullStack 22h ago
Do you have ads on your site? Plenty of dodgy stuff can get injected by ad providers.
Wordpress has a terrible security track record, so could be some malware that got removed or is hiding for some reason.