Our Search Console report had a bucket we'd already written off as harmless: "Alternate page with proper canonical tag." On fanpino.com that category is normally query-string variants of the pricing and contact pages pointing back at their clean URL, which is exactly what should happen. This time it had 79 pages and a validation that had failed.
The summary lied by omission
The report's top-level numbers told us nothing. Only when we opened the example URLs did it make sense: none of them were on fanpino.com itself. Every one was an old subdomain of ours, hit with a different cache-busting query string each time, so each crawl looked like a brand-new page.
That subdomain hadn't been part of our stack for a long time. The DNS record was still there, pointing at a server we don't run, and the TLS certificate on that server had expired. So Google kept finding a hostname under our domain, kept failing to fetch it cleanly, and kept filing it under our site's health report.
Why it landed in our report at all
We verify Search Console as a domain property, not a URL-prefix property. A domain property covers every subdomain automatically. That's convenient when everything under the domain is yours and current. It also means any stale record in your DNS zone becomes your problem in the report, whether or not you remember it exists.
The fix was one deletion
We removed the DNS record. We didn't try to renew a certificate on a server we don't manage, and we didn't add redirects for a hostname nothing should be linking to. With the name gone, there's nothing left for a crawler to reach, and the bucket should empty out over the next few crawl cycles.
What we'd tell anyone running a domain property
Open the example URLs before deciding a category is fine. Our own assumption about what lived in that bucket was correct for months and wrong this time, and the aggregate count gave no hint which. And every so often, read your DNS zone top to bottom and ask of each record: is this still ours, and does it still point at something we look after?