I've set up Content-Security-Policy-Report-Only header, and am in report-uri getting relatively high number (several hundred per month) of failed requests on img-src
for suspicious URLs:
https://netanalytics.xyz/metric/
https://netanalitics.space/metric/
https://glganltcs.space
there are also some which look even more hacked:
script-src on https://etgfsiwxsbxr.ru/d6safundjenk6af/29915.js
connect-src on http://gj.track.uc.cn/collect
and even some supposed style accesses for fonts?!
{
"csp-report": {
"blocked-uri": "https://fonts.googleapis.com",
"document-uri": "https://biciklijade.com/",
"original-policy": "default-src 'none'; manifest-src https://biciklijade.com; script-src https://biciklijade.com; style-src https://biciklijade.com; connect-src https://biciklijade.com; form-action https://biciklijade.com; img-src https://biciklijade.com https://*.tile.openstreetmap.org https://*.tile.osm.org data:; report-uri https://biciklijade.report-uri.com/r/d/csp/reportOnly",
"violated-directive": "style-src"
}
}
Note that I at most specify CSS body { font: 16px/21px Arial, "Helvetica Neue", Helvetica, sans-serif; }
without ever specifying src
to download fonts from google (or anyone else), so IMHO browsers should never be connecting to google to get them, right?
I've checked the code and databases to make sure that they haven't been cracked, and they all look just fine. Browsing the site from Firefox and Chromium with developer console open also does not seem to trigger any CSP violations. The site is mostly hand made and is not supposed to be using any analytics.
Question 1: Do any of those look legitimate to you? They don't to me; and I'd like to move CSP from report-only to real blocking
Question 2: If those are indeed non-legitimate accesses, is it possible they all come from cracked clients, instead of infected website? I've already checked, and website seems clean, but I'd like some reassurances that other people are seeing stuff like that too