All Vendors
data_enrichment

Semcasting

Identity resolution platform with comprehensive cross-domain tracking and behavioral profiling. Perfect CAC subsidization and legal tail risk scores indicate severe privacy violations and competitive intelligence leakage.

86 IOCs59 detections7% pre-consent56 sites
80
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Semcasting discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

59 detections across 56 sites7% pre-consent activity
MEDIUM

Pre-Consent Activity

Semcasting was observed loading and executing before user consent was obtained on 7% of sites where it was detected.

GDPRePrivacy
Disclosure Gaps

Claims vs. Observed Behavior

1 gaps

pending

UNKNOWN
They Claim

“Unknown”

Observed Behavior

Requires claims extraction via CDT

Customer Impact

What This Means For You

Every visitor you track enriches Semcasting identity graphs used by competitors for targeting and suppression. Your audience insights become shared competitive intelligence. If you identify high-value segment, competitors can target same users through shared identity resolution. Meanwhile, 40%+ signal loss from privacy controls makes your segments systematically unrepresentative.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Semcasting

  • →Audit identity resolution rates - quantify signal loss from privacy controls to understand audience bias
  • →Request identity graph segregation - your visitor data should not enrich competitor profiles
  • →Verify consent timing - cross-domain sync must not initiate before explicit opt-in
  • →Implement first-party identity resolution without cross-site tracking

If You're Evaluating Semcasting

  • →First-party CDPs with hashed email matching (no cross-domain tracking)
  • →Server-side identity resolution with explicit data sharing controls
  • →Privacy-preserving cohort targeting (Google Privacy Sandbox FLoC)

Negotiation Leverage

  • →Perfect CAC subsidization (100) means your visitor data trains all competitor audience models - demand complete data segregation
  • →Perfect legal tail risk (100) indicates violations across all privacy frameworks - DPA must include unlimited indemnification
  • →Cross-domain tracking requires GDPR Article 35 DPIA - request documentation or accept compliance gaps
  • →Persistence mechanisms create multi-year liability - confirm retention limits and consent renewal requirements
  • →Platform value derives entirely from shared identity graphs - pricing should reflect your data contribution
Runtime Detections

Runtime Detections

6 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

BTI-C08Cross-Domain Sync

Identity stitching

Impact: Identity resolution across sites constitutes large-scale profiling under GDPR Article 35, requiring Data Protection Impact Assessment and DPO notification.

BTI-C09Consent Bypass

Ignoring CMP signals

Impact: Cross-site tracking initiates before any consent mechanism, creating strict liability for every visitor interaction under GDPR Article 82.

BTI-C10Fingerprinting

Device identification

BTI-C15Tag Manager

Container/loader (neutral)

Impact: Long-lived identifiers enable multi-year tracking without consent renewal, violating ePrivacy Directive Article 5(3) and creating unlimited liability accumulation.

IOC Manifest

IOC Manifest

62 INDICATORS

Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*www.semcasting.com/hs/cta/cta/current.js*
Tracking script
TRACK
*www.semcasting.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js*
Tracking script
TRACK
*www.semcasting.com/hs/hsstatic/content-cwv-embed/static-1.*/embed.js*
Tracking script
TRACK
*www.semcasting.com/hubfs/hub_generated/template_assets/1/*/*/template_jquery-modal-min.js*
Tracking script
TRACK
*www.semcasting.com/hubfs/hub_generated/template_assets/1/*/*/template_number-count-up.js*
Tracking script
TRACK
*www.semcasting.com/hs/scriptloader/*.js*
Tracking script
TRACK
*www.semcasting.com/hs/hsstatic/HubspotToolsMenu/static-1.432/js/index.js*
Tracking script
TRACK
*www.semcasting.com/_hcms/forms/v2.js*
Tracking script
TRACK
*www.semcasting.com/hubfs/hub_generated/template_assets/1/*/*/template_clean-pro.js*
Tracking script
TRACK
*www.semcasting.com/hs/cta/ctas/v2/public/cs/cta-loaded.js*
Tracking script
TRACK
www.semcasting.com/hs/cta/cta/current.js
Auto-extracted from scan
TRACK
www.semcasting.com/hs/hsstatic/content-cwv-embed/static-1.1293/embed.js
Auto-extracted from scan
TRACK
www.semcasting.com/hubfs/hub_generated/template_assets/1/102496720675/1764096593585/template_clean-pro.min.js
Auto-extracted from scan
TRACK
www.semcasting.com/hubfs/hub_generated/template_assets/1/55596275265/1764096593863/template_jquery-modal-min.min.js
Auto-extracted from scan
TRACK
www.semcasting.com/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js
Auto-extracted from scan
TRACK
www.semcasting.com/_hcms/forms/v2.js
Auto-extracted from scan
TRACK
www.semcasting.com/hubfs/hub_generated/template_assets/1/55596345418/1764096604973/template_number-count-up.min.js
Auto-extracted from scan
TRACK
www.semcasting.com/hs/scriptloader/5246312.js
Auto-extracted from scan
TRACK
www.semcasting.com/hs/hsstatic/HubspotToolsMenu/static-1.432/js/index.js
Auto-extracted from scan
TRACK
www.semcasting.com/hs/cta/ctas/v2/public/cs/cta-loaded.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

Integrates with DSPs, CDPs, DMPs. Shares identity graphs across advertiser network. Requires pixel deployment across all digital properties.
Loads (1)
Hubspot
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

86 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details