Intercept teardown · iOS · 2026-08-11

AI Video Generator A full-stack read of HUBX's paid-social funnel — ad creative through attribution, paywall assignment, model selection and unit economics — reconstructed from 1,586 decrypted requests off a single attributed install.

Target AI Video – AI Video Generator (id6478868302) Vendor HUBX Yazılım Hizmetleri A.Ş. Method Proxyman MITM, physical iPhone Entry Live Meta ad → attributed install
Image → video modelFALAI_NANO_BANANA_IMAGE_
HIGGSFIELD_KLING_MOTION_CONTROL_VIDEO
fal.ai · nano-banana · Higgsfield/Kling
Paywall placements19Adapty, each its own A/B test
Distinct SKUs347 weekly price points + 8 intro ladders
Attributionfacebook_w2aAppsFlyer → Adapty, non-organic
01

The one-sentence version

HUBX runs one proven creative at enormous duplication into a web-to-app bridge that hands AppsFlyer a deferred deep link; that attribution is forwarded into Adapty, which holds 19 paywall variants and 34 SKUs and prices you according to the ad you clicked. The product itself is a thin orchestration layer over fal.ai — the model is chosen server-side, per feature, at request time.

The strategic read

Their moat is not the model — it's the same fal.ai stack anyone can rent. The moat is the measurement loop: creative → deferred deep link → per-campaign paywall variant → validated purchase, all wired end-to-end so every price point is attributable back to an ad. That is the thing worth copying.

02

The funnel, hop by hop

Every hop below was walked live and captured. The chain matters because each link carries a parameter forward — lose one and the paywall assignment changes.

Hop 1 · Meta
~900 active US ads, 6 destinations
Of 194 ads sampled, 162 run a single angle — “🤣🕺Join the Dance trend with just one photo” — live since Apr 27, 2026. A second angle (AIVLOG) launched Aug 7. Three Instagram creator handles carry UGC variants. Four separate FB pages spread the buy. ✓ verified
Hop 2 · Lander
Campaign-coded bridge page
Not an App Store link — a lander whose path and query encode the creative. It returns 200 to curl but only redirects in a real browser: the handoff is client-side JavaScript, which matters if you ever script this.
aivideoart.co/get-started-v5?target=meta&deep_link_value=genericDance
Hop 3 · Web-to-app
AppsFlyer OneLink + a third-party w2a bridge
The lander loads aivideo.onelink.me/0DoU and w2ahub.com/w2a/appsflyer.js. This is where the click is recorded and the deep link is parked for retrieval after install.
Hop 4 · App Store
Custom Product Page, not the default listing
OneLink 301s to a campaign-specific product page. Both OneLink variants resolve to the same ppid, so this campaign runs one CPP. ✓ verified
apps.apple.com/US/app/id6478868302?mt=8&ppid=[ID_REDACTED]
Hop 5 · First launch
The deep link survives the install
AppsFlyer returns the parked value to the fresh install — 4m 51s after the click. This is the payload that makes the whole loop work.
deep_link_value = "genericDance" · af_status = "Non-organic" · media_source = "facebook_w2a"
03

First launch, second by second

The most revealing 15 minutes. Note what happens at 21:08:39 — before a single screen is shown.

21:08:39
All 19 paywall configs pre-fetched in one burstAdapty pulls dummy_paywall_list and offer_2 … offer_20 simultaneously, before onboarding renders. Every variant is on-device from the first second, so the paywall can be swapped with zero latency.
21:08:40
App identifies the userGET /user/me → anonymous userId + Firebase uid
21:08:42
Onboarding + paywall config pulledGET /udls?locale=en — server-driven onboarding decks keyed to seasonal campaigns (a christmas2025 deck is still in the payload)
21:08:43
Feature catalog + zero balancePer-feature coin costs arrive with the catalog. Wallet opens at balance: 0, isPremium: false
21:09:10
Deferred deep link resolvedAppsFlyer returns genericDance, af_status: Non-organic, campaign: facebook_w2a-campaign
21:09:13
Attribution forwarded into AdaptyPOST /sdk/attribution/profile/set/data/ — this is the join between the ad you clicked and the price you're shown
21:12:06
App Store purchase validatedPOST /sdk/purchase/app-store/original-transaction-id/validate/
21:13:44
Entitlement flips — 1,500 coins grantedisPremium: true, isTrial: false, originalTransactionId: 170003761419770. Refill timer set to ~7 days (10079 min).
21:14:41
Cost gate before generationGET /ruleCheck → {status:true, cost:600}
21:14:42
Model resolved server-side, per featureGET /features/gangsta-dance/model → FALAI_NANO_BANANA_IMAGE_HIGGSFIELD_KLING_MOTION_CONTROL_VIDEO
21:14:43
Generation starts, coins debited immediatelyBalance 1500 → 900 at request time, not on delivery
21:19:23
Render completes — 4m 40sSigned Google Cloud Storage URL returned (project hubx-aivd-p)
21:21:56
Second feature, different model, different priceimage-to-video → FALAI_KLING_21_STD_IMG2VID, cost 200. Completed in 73s.
04

The engine: fal.ai, selected at runtime

The single most useful finding. The app does not hardcode a model — it asks the server which model to use, per feature, on every generation.

FeaturemodelKey returnedCoinsWall clock
gangsta-danceFALAI_NANO_BANANA_IMAGE_HIGGSFIELD_KLING_MOTION_CONTROL_VIDEO6004m 40s
image-to-videoFALAI_KLING_21_STD_IMG2VID20073s
copenhagen-vlog-10s— (catalog only, not generated)1350—

Decoded, the naming is a pipeline description: nano-banana produces the styled still, then Higgsfield + Kling motion control animates it. Plain image→video skips the first stage and goes straight to Kling 2.1 Standard. All of it served through fal.ai. ✓ verified — decoded response bodies

Generation contract

// the entire request body — no prompt, no model, no params
POST /process/img-video
{"imagePath":"user-inputs/<uid>/1786482866637"}
→ {"processId":"a5b5c8f4-…"}

// then poll every ~5s
GET /result/<processId>
→ {"status":"PROCESSING","remainingTime":4}   // counts 5→1, not %
→ {"status":"COMPLETED","videoUrl":"https://storage.googleapis.com/…"}

The prompt and model live entirely server-side; the client sends only a storage path. That means they can re-price, re-prompt or swap the whole model stack without shipping an app update — and it means the client is trivially cheap to maintain.

Worth stealing

remainingTime counting 5 → 1 instead of a percentage. A countdown that only ever moves down never stalls visibly at 87%, which is where progress bars lose people on a 4-minute render.

05

Monetization: a price-testing machine

Adapty, public SDK key [PUBLIC_SDK_KEY_REDACTED]. Nineteen placements, each registered as its own named A/B test, and 34 distinct products. The SKU names are self-documenting.

Weekly subscriptions — seven live price points

Product IDShapePrice
aivideo_weekly_direct_ios_699Direct weekly$6.99
aivideo_weekly_direct_ios_999Direct weekly$9.99
aivideo_weekly_direct_ios_1299Direct weekly$12.99
aivideo_weekly_direct_ios_1499Direct weekly$14.99
aivideo_weekly_direct_ios_1599Direct weekly$15.99
aivideo_weekly_direct_ios_1999Direct weekly$19.99
aivideo_weekly_direct_ios_6999Direct weekly — outlier probe$69.99
aivideo_weekly_3dft_ios_12993-day free trial → weekly$12.99
aivideo_yearly_direct_ios_1999Annual$19.99

Intro → renew ladders — eight combinations

Every one encodes both ends of the ladder in the SKU name, so the intro price and the renewal it steps up to are tested as a pair rather than independently.

Product IDIntroRenews atStep-up
aivideo_weekly_intro_ios_199_to_999$1.99$9.995.0×
aivideo_weekly_intro_ios_399_to_999$3.99$9.992.5×
aivideo_weekly_intro_ios_499_to_999$4.99$9.992.0×
aivideo_weekly_intro_ios_499_to_1299$4.99$12.992.6×
aivideo_weekly_intro_ios_499_to_1499$4.99$14.993.0×
aivideo_weekly_intro_ios_699_to_999$6.99$9.991.4×
aivideo_weekly_intro_ios_699_to_1299$6.99$12.991.9×
aivideo_weekly_intro_ios_699_to_1499$6.99$14.992.1×

Coin consumables — the same pack sold at two prices

Product IDCoinsPriceCoins / $
aivideo_150_credit_consumable_ios_299150$2.9950
aivideo_300_credit_consumable_ios_499300$4.9960
aivideo_600_credit_consumable_ios_799600$7.9975
aivideoprod_1000_credit_consumable_ios_3991000$3.99251
aivideoprod_1000_credit_consumable_ios_5991000$5.99167
aivideoprod_1500_credit_consumable_ios_4991500$4.99301
aivideoprod_1500_credit_consumable_ios_7991500$7.99188
aivideoprod_2000_credit_consumable_ios_6992000$6.99286
aivideoprod_2000_credit_consumable_ios_9992000$9.99200

The aivideo_* and aivideoprod_* families differ by roughly 4–5× in coins per dollar for overlapping price points. ~ inferred — the likeliest reading is a legacy pack set being retired against a far more generous current one, but I can't confirm which cohort sees which from a single install.

Unit economics, from their own numbers

A $12.99 weekly grants 1,500 coins. The flagship dance render costs 600 — so the headline subscription buys two and a half of the thing the ads sell, then refills weekly. Coins are debited at request time, not on delivery, so a failed render is still a paid render unless they refund it.

06

The loop that ties it together

Creative identity is carried all the way from the ad into the pricing engine. This is the part most teams never wire up.

// AppsFlyer returns the parked click to the fresh install
GET 1xnhtg.gcdsdk.appsflyersdk.com/install_data/v5.0/id6478868302
→ {
    "deep_link_value": "genericDance",     // ← the creative
    "af_status":       "Non-organic",
    "media_source":    "facebook_w2a",
    "campaign":        "facebook_w2a-campaign",
    "install_time":    "2026-08-11 21:09:09.120"
  }

// …and is immediately handed to the paywall engine
POST api.adaptytech.com/api/v1/sdk/attribution/profile/set/data/
{ "source": "appsflyer",
  "profile_id": "[ID_REDACTED]",
  "attribution_json": "{\"media_source\":\"facebook_w2a\", …,
                        \"click_time\":\"2026-08-11 21:04:18.840\"}" }

Click at 21:04:18, install at 21:09:09, attribution inside Adapty by 21:09:13. From then on every Adapty profile read carries media_source: facebook_w2a, which is what lets a placement resolve to a different price for ad traffic than for organic. ✓ verified — full payloads captured

07

Everything else on the wire

VendorHostIdentifierRole
Adaptyapi.adaptytech.com · configs-cdn.adapty.io[PUBLIC_SDK_KEY_REDACTED]Paywalls, A/B, receipt validation
AppsFlyer*.appsflyersdk.comdev key 1xnhtg · SDK 6.18Attribution + deferred deep link
Microsoft Clarityj.clarity.mslf10p2h8m1In-app session recording
OneSignalapi.onesignal.com[ID_REDACTED]Push
Firebase / GAapp-analytics-services.com—Product analytics, storage
Meta SDKep1/ep2.facebook.com—App events back to Ads
Google Cloudstorage.googleapis.comhubx-aivd-pRender delivery, signed URLs

The one that should raise an eyebrow: Microsoft Clarity is recording sessions inside the app. Combined with Adapty's placement data they can watch, screen by screen, where a given paywall variant loses people — not just that it converted worse.

08

What this capture cannot tell you

Gap 1 — StoreKit is invisible

Apple domains were deliberately excluded from decryption, because MITM-ing certificate-pinned Apple services breaks the App Store outright and the install can't complete. Every price above comes from Adapty's payloads, not Apple's receipts. ⚠ not independently confirmed against StoreKit

Gap 2 — one install, one assignment

All 19 placement configs were captured, but a single device only ever gets one assignment. Which offer maps to which campaign, and how prices differ for organic traffic, needs repeat installs across different creatives to establish.

Gap 3 — the exit-intent path wasn't walked

Dismissing a paywall is where these apps typically fire a second, cheaper offer. That path wasn't exercised, so any downsell variant is unobserved.

09

What to do with this