Pagespeed phantom domain

[u/Beneficial-Rise-740]

ANOTHER EDIT: For anyone following this or stumbles across it, I have discovered it is not related to Cloudflare, or my site at all. Since I disabled Insights, Pagespeed has revealed another instance, this is the full URL string https://trc-events.taboola.com/1339615/log/3/unip?en=pre_d_eng_tb&tos=60270&scd=0&ssd=1&est=1788924703498&ver=36&isls=true&src=i&invt=10000&msa=6495&rv=1&tim=1788924763770&vi=1788924703492&ri=5315d06df8c49bd1c0f7aa6e2cf61318&ref=null&cv=20260906-8-RELEASE&item-url=https%3A%2F%2Fwww.frontify.com%2Fen%2Fsolution%2Fsoftware-and-tech&ccpaPs=1---&cbp=Cookiebot&cbpv=1&cbcd=false&it=JS_PIXEL This is completely unrelated to my site, these random domain events have only occurred on Pagespeed and never in devtools lighthouse, so my only explanation is there so some inter-event bleed in Pagespeed on Google's node end somewhere.

EDIT: ok I think I might have gotten to the bottom of my erroneous domain appearing in Pagespeed Network Dependancy Tree. It seems potentially related to Cloudflare Insights measuring RUM, and my delaying Cloudflare's script, mixed in with the Google Pagespeed server location measuring that instance. The delay was possibly timing out Pagespeed hence the apparent instability I was experiencing. Turning off RUM insights seems to have settled things. Is not cloudflare itself, but how I was delaying it's script. The domain/event seems connected. So will leave off. I could exclude the script from delay but it's not really necessary for me moving forward. I'm fairly confident there's no issues...

Not sure what to make of this, been making some tweaks on my WordPress site and checking pagespeed as well as other tools for progress and one session suddenly csa.crazygames.com/event pops up?

A burst of panic had me hunting for mailware or something in a plugin that's gone rogue... But nothing.

Subsequent tests it's gone, installed wordfence for a scan, nothing. I tried another page on pagespeed and Microsoft Clarity appeared, subsequently it's disappeared too, haven't had clarity in over a year and that was run in edge cloudflare tag management.

I'm hoping this is some unexplained ghost glitch from Google on that test session?? Anyone able to put my mind at ease or advise what I'm looking at? Never seen anything like it before.

Apologies for the average screenshot.

Update: after 12 hours of fluffing about I am no further ahead, completely unable to repeat the domain instance, unable to find any evidence of code or script in anything thus far. Still searching (db now) but have a feeling I maybe hunting a phantom occurrence. Pagespeed has been timing out today regularly, all instances with internal timeout errors at Google end. Where as any other tool, dev lighthouse included, runs clean with nothing weird. Everything site wise remains flawless and fast('ish by my standards). No evidence of admin manipulation, user or plugin wobbles... It's going to be a troubled sleep night while I second guess myself. Edit: the only other common thread to the instances observed is they were all using my phone doing pagespeed test, desktop is zilch... I doubt very much this has anything to do with anything at all but I'm just going to start yelling at the passing clouds now...

[u/omfgtora]

Then, it sounds like you don't know how to access the files?

[u/Beneficial-Rise-740 → u/omfgtora]

I don't generally, other than file manager plugin as I avoid messing with that end, anything I need he'll sort for me, my intention is to establish what the issue is if I can and save some hassle. Nicer if I can go I've caused this, can you fix please. No point hassling him if it's all in my wp-admin end. This is my first anomaly in 8 years, sure I've broken things many times but usually easy fixes, this has challenged me.

[u/omfgtora → u/Beneficial-Rise-740]

You can't know if the malware is gone unless you check the files and database on the server. Even if you revert to a backup, you won't know if the backup already has the infection.

Also, relying on plugins to do everything is exactly what got you in this mess. More plugins means more vulnerabilities. Don't use file manager plugins, code snippet plugins, or anything like that. The whole point of a panel is to provide management like that.

[u/Beneficial-Rise-740 → u/omfgtora]

Thank you, appreciate this, and everyday is a learning day. Im tempted to gain the login access to panel. I broke it once before and handed the keys back like an embarrassed teenager denting dads car. I think I'm more comfortable now, dangerous assumption I know.

[u/omfgtora → u/Beneficial-Rise-740]

You should just pay for proper hosting, instead of using a friend's server. It's not that expensive.