Content-Security-Policy suspicious entries in the log

Question

I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src for suspicious URLs:

https://netanalytics.xyz/metric/
https://netanalitics.space/metric/
https://glganltcs.space

there are also some which look even more hacked:

script-src on https://etgfsiwxsbxr.ru/d6safundjenk6af/29915.js
connect-src on http://gj.track.uc.cn/collect

and even some supposed style accesses for fonts?!

{
    "csp-report": {
        "blocked-uri": "https://fonts.googleapis.com",
        "document-uri": "https://biciklijade.com/",
        "original-policy": "default-src 'none'; manifest-src https://biciklijade.com; script-src https://biciklijade.com; style-src https://biciklijade.com; connect-src https://biciklijade.com; form-action https://biciklijade.com; img-src https://biciklijade.com https://*.tile.openstreetmap.org https://*.tile.osm.org data:; report-uri https://biciklijade.report-uri.com/r/d/csp/reportOnly",
        "violated-directive": "style-src"
    }
}

Note that I at most specify CSS body { font: 16px/21px Arial, "Helvetica Neue", Helvetica, sans-serif; } without ever specifying src to download fonts from google (or anyone else), so IMHO browsers should never be connecting to google to get them, right?

I've checked the code and databases to make sure that they haven't been cracked, and they all look just fine. Browsing the site from Firefox and Chromium with developer console open also does not seem to trigger any CSP violations. The site is mostly hand made and is not supposed to be using any analytics.

Question 1: Do any of those look legitimate to you? They don't to me; and I'd like to move CSP from report-only to real blocking

Question 2: If those are indeed non-legitimate accesses, is it possible they all come from cracked clients, instead of infected website? I've already checked, and website seems clean, but I'd like some reassurances that other people are seeing stuff like that too

Answer 1

Question 1: Do any of those look legitimate to you?

Yes, they seem legitimate. There are high chances that they are due to some browser plugins. Some plugins injects code in the dom which will result in these violation.
It could be possible that your users use such plugins. (I personally found such plugins to be pretty common and used by many)

I'd like to move CSP from report-only to real blocking

That would be great. However, you must evaluate all scenarios and a proper action in place in case when it's actually happening because of your code. (Or else, the resource will be blocked and the site will not be usable anymore)

• I suggest testing all pages and in multiple browsers before changing to block mode.
• Also, it would be great if the mode can be changed without much effor. I mean, if runtime you got an issue, then you should be able to do it with negligible downtime.

Question 2: If those are indeed non-legitimate accesses, is it possible they all come from cracked clients, instead of infected website?

I don't have much experience in this part.

On a side note, you could explore the possibility of supporting for only those clients which support CSP. For others, you can block or just display an error message. (Again, this is specific to your usage. To check this part, you can collect client details for first few weeks/months and then decide whether you should follow such strategy)

Further Reading

I found Dropbox blog to be really helpful in rolling out a strategy in filtering the reports and moving to block. You might find it useful : Dropbox Blog on CSP