Today I was digging around for a way to block certain domains in GA4 (ultimately I went with a trigger in GTM instead), when I came across the "Configure your domains" menu. It suggested a few domains I recognize, mainly our own dev environments, but then also gwern.net.
I'm curious, does anyone know how GA4 comes up with it's suggestions, and why this gwern.net domain would even pop up? I did some light Googling about the site and it seems to be tied to someone who writes about the darknet, nootropics and crypto (the site I work on has nothing to do with any of these topics, and we definitely don't link to that persons site).
It probably just selects hits that came in into this property having a hostname that is not in the list of cross-domain tracking hostnames.
Why did gwern get there? GA spam could be one thing. Maybe someone was testing something there and sent a few hits to your property? I frequently test foreign GTM containers on sites they're not supposed to fire on. I also frequently test things, setting some random measurement ids. I'm sure others do this stuff from time to time.
There's also a way to open a site from a different domain, either by manipulating cnames or local dns records. Maybe one of your front-end devs has this site as a side-project and mixed up their local dns settings, opening your site from gwern's domain. There are many ways for a network request to end up with wrong data.